How do I get rid of "internet anti-virus"???

jady · #1 08-15-2008, 08:07 AM

A buddy of mines daughter got a nasty app on her computer called internet anti-virus. It slowed up her system really bad. It is one of those apps that "scans" your computer and finds 40 virus and malware occurances that arent really there and says it won't get rid of them until you pay the 49.99 for the software.

It also does not show up in the add/remove software list.

I killed the process in the task manager first and then deleted the folder in program files. I then scanned the registry for all the entries related to it and deleted them. everything seemed to be running smooth until last night when a popup for it appeared in firefox!?!?!? It is saying that the link she clicks is going to a website that has a virus on it and to buy the protection again.

How do I kill this beast completely?????

FL Knifemaker · #2 08-15-2008, 08:11 AM

They feed on PrOn. Stay off the Pr0n sites for 72 hours and it will die.

DigMe · #3 08-15-2008, 08:14 AM

Try malwarebytes free edition malware program. Download, install and run. Then reboot into safe mode and run another full scan. It's a pretty good malware scanner/killer.
http://www.malwarebytes.org/

If that doesn't work then follow this guy's instructions:
http://www.youtube.com/watch?v=wHAYI-NAmOs

bc

Chunk-O-Funk · #4 08-15-2008, 08:19 AM

I cleaned up a computer at work the other day with a nasty virus too. Someone downloaded a simple picture and everything went wrong from there.

Did you try "spybot search and destroy"?
It found a whole bunch of stuff the anti-virus loaded in the computer never did.

Just save yourself one step and run spybot in safe mode. Those types of virus can't get deleted when it's running.

jady · #5 08-15-2008, 08:19 AM

Quote:

Originally Posted by FL Knifemaker

They feed on PrOn. Stay off the Pr0n sites for 72 hours and it will die.

It's my buddies 16 year old daughters system..........

My personal Pr0n is nice and safe thank you very much

TheDarkReaver · #6 08-15-2008, 08:22 AM

Quote:

Originally Posted by jady

It's my buddies 16 year old daughters system..........

Maybe she likes the pr0n?

Revvv · #7 08-15-2008, 08:26 AM

Quote:

Originally Posted by DigMe

Try malwarebytes free edition malware program. Download, install and run. Then reboot into safe mode and run another full scan. It's a pretty good malware scanner/killer.
http://www.malwarebytes.org/

If that doesn't work then follow this guy's instructions:
http://www.youtube.com/watch?v=wHAYI-NAmOs

bc

That should do it.

My wife ended up with the same crap. All she did was download a pic to use for a powerpoint. No porn guys. It was a slide for Church. (It could have been porn, but the Church would have gotten an awakening. A rude one nonetheless).

jady · #8 08-15-2008, 08:26 AM

Quote:

Originally Posted by Chunk-O-Funk

I cleaned up a computer at work the other day with a nasty virus too. Someone downloaded a simple picture and everything went wrong from there.

Did you try "spybot search and destroy"?
It found a whole bunch of stuff the anti-virus loaded in the computer never did.

Just save yourself one step and run spybot in safe mode. Those types of virus can't get deleted when it's running.

Already did and it didn't see it.

Quote:

Originally Posted by DigMe

Try malwarebytes free edition malware program. Download, install and run. Then reboot into safe mode and run another full scan. It's a pretty good malware scanner/killer.
http://www.malwarebytes.org/

If that doesn't work then follow this guy's instructions:
http://www.youtube.com/watch?v=wHAYI-NAmOs

bc

I will give that a try thanx.

Sonic_Death · #9 08-15-2008, 08:30 AM

SDFix and ComboFix.

Use SDFix first.

Here is a guide: http://www.bleepingcomputer.com/forums/topic131299.html

Start reading from SDFix Instructions

It usually works very well for removing such things. You need to run SDFix in safe mode.

BlackLake · #10 08-15-2008, 08:32 AM

Quote:

Originally Posted by DigMe

Try malwarebytes free edition malware program. Download, install and run. Then reboot into safe mode and run another full scan. It's a pretty good malware scanner/killer.
http://www.malwarebytes.org/

If that doesn't work then follow this guy's instructions:
http://www.youtube.com/watch?v=wHAYI-NAmOs

bc

I just fought this one off...Malwarebytes did great (along with my AVG software), but for a couple of days I still had a popup that would only give me the option Enable Protection, which would lead to a website popup. Yesterday (after doing nothing) I had a message that Malicious Software had been removed, and it's all good.

I also used CCleaner ( www.ccleaner.com ) this will get rid of extra crap, and fix your registry too.

All are free.

**john turner** · #11 08-15-2008, 08:35 AM

-sharpens axe, eagerly awaiting the arrival of the first poor fool to say "get a mac"

DigMe · #12 08-15-2008, 08:39 AM

Quote:

Originally Posted by BlackLake

I just fought this one off...Malwarebytes did great (along with my AVG software), but for a couple of days I still had a popup that would only give me the option Enable Protection, which would lead to a website popup. Yesterday (after doing nothing) I had a message that Malicious Software had been removed, and it's all good.

I also used CCleaner ( www.ccleaner.com ) this will get rid of extra crap, and fix your registry too.

All are free.

Did you initially run malwarebytes in safe mode as well?

bc

BlackLake · #13 08-15-2008, 08:45 AM

Quote:

Originally Posted by DigMe

Did you initially run malwarebytes in safe mode as well?

bc

No...I just ran it normal...I did it about 4 times, until it stopped finding stuff, then I just played the waiting game...the popup wasn't so bad, it would only happen once in a while when I opened a new program, 2 clicks and it was gone for a while.

Not sure what did the final fix though, I would imagine it was AVG because I didn't have MWB running at the time.

I also ran ccleaner a few times, untill it didn't find anything to fix.

Best of luck.

Alcyon · #14 08-15-2008, 12:35 PM

Quote:

Originally Posted by john turner

-sharpens axe, eagerly awaiting the arrival of the first poor fool to say "get a mac"

Mwahahahaha. You know you want one...

Liist · #15 08-15-2008, 12:40 PM

Macs are so overrated it's not even funny.

I used sdfix.exe to get rid of all my problems. Be careful as it may **** up your computer if you don't know what you're doing. As an Asian computer nerd, I'm fine with using this simple, but powerful application.

MonetBass · #16 08-15-2008, 12:45 PM

This sounds like one of those apps that likes to hide.
* Without anything open, delete all files in "Documents and Settings\<username>\Local Settings\Temp" and "Windows\Temp"
* Also look for any fishy-looking folders in "Local Settings\Application Data"
* Try HijackThis (assuming you know your way around the registry)

gdthomas · #17 08-15-2008, 10:12 PM

If they are running XP make sure the system restore feature is turned off, boot into safe mode and run the scans. That should really help the cleaning process.