Warning

 

Close
Confirm Action

Are you sure you wish to do this?

Cancel Confirm
AR15.COM
1/15/2012 11:13:00 AM EDT
Somehow I got a malware or spyware that says "Win 7 Antivirus 2012" keeps coming up and saying my computer is unprotected and I need to purchase their software to "clean" it.





I know this is an infection but Windows essentials wont pick it up and Malwarebytes is being prevented from running.





What can I do?

 
1/15/2012 11:14:02 AM EDT
[#1]
Reboot in safe mode, run malware bytes and spybot search and destroy.
1/15/2012 11:16:14 AM EDT
[#2]
http://www.bleepingcomputer.com/virus-removal/remove-vista-internet-security-2012

I bet it's the same thing I had.  I read somewhere that it uses several names.  I had to reboot in safe mode and then go to this site and follow the directions.....took about an hour but it worked.


I was reading an article on chuckhawks.com when all of the sudden my computer went nuts......
1/15/2012 11:16:53 AM EDT
[#3]
Quoted:
Somehow I got a malware or spyware that says "Win 7 Antivirus 2012" keeps coming up and saying my computer is unprotected and I need to purchase their software to "clean" it.

I know this is an infection but Windows essentials wont pick it up and Malwarebytes is being prevented from running.

What can I do?


I've been able to run malwarebytes as administrator and get rid of that piece of shit.  Whoever wrote that virus deserves a grenade up the butt.
1/15/2012 11:17:57 AM EDT
[#4]
Quoted:
Somehow I got a malware or spyware that says "Win 7 Antivirus 2012" keeps coming up and saying my computer is unprotected and I need to purchase their software to "clean" it.

I know this is an infection but Windows essentials wont pick it up and Malwarebytes is being prevented from running.

What can I do?



go to bleepingcomputer.com and do a search. they'll have specific instructions. good luck.
1/15/2012 11:23:40 AM EDT
[#5]
Trinity Repair/Rescue Kit.

Google it, burn a CD-ROM, boot from it.

This has NEVER failed me.

30 minutes and you are GTG.

Also install a free anti-virus like AVG, Avast or similar.

Please file an AAR

Good Luck
1/15/2012 11:26:29 AM EDT
[#6]
i used to do tech support and all the posts above me are what i did to fix the issues
1/15/2012 11:28:00 AM EDT
[#7]



Quoted:


Reboot in safe mode, run malware bytes and spybot search and destroy.


Getting the same shit in safe mode. Not letting me run those there either.



 
1/15/2012 11:31:33 AM EDT
[#8]
Quoted:

Quoted:
Reboot in safe mode, run malware bytes and spybot search and destroy.

Getting the same shit in safe mode. Not letting me run those there either.
 


Do you have another computer and a thumbdrive?  If you can download malwarebytes onto thumbdrive from other computer, and put thumbdrive into infected computer and run malwarebytes.  Atleast that has worked for me.
1/15/2012 11:36:09 AM EDT
[#9]
Quoted:

Quoted:
Reboot in safe mode, run malware bytes and spybot search and destroy.

Getting the same shit in safe mode. Not letting me run those there either.
 


I am not an IT guy but I had to turn off the internet connection of the infected computer, download the above suggested apps from a non-infected computer to a thumb drive, download to the infected computer, and then run the apps.  While their is probably an easier way, turning off the internet was the only way I could keep the infection at bay long enough to run the malware bytes.
1/15/2012 11:47:57 AM EDT
[#10]
i had this a while back... malware bytes antimalware took care of it no problem for me http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;1

hopefully you already have this on your computer.....if you dont you have to rename it when you download it and a bunch of other stuff....there are tutorials on google but man it was a bitch.  best if you already have the program.
1/15/2012 11:51:05 AM EDT
[#11]
If you are quick, and can get a ctr+alt+delete in at startup (before the virus gets done loading completely) you can kill the process for it (look for one with a really strange name) and then you should be able to run malwarebytes.
1/15/2012 11:53:26 AM EDT
[#12]
Quoted:

Quoted:
Reboot in safe mode, run malware bytes and spybot search and destroy.

Getting the same shit in safe mode. Not letting me run those there either.
 

Oh, is it asking you what you should open the file with? Or does it open another instance of the fake virus software? If the latter, then my last post applies. If it is acting like it does not know what the file type is and asking you to select the program to open it with from a list you will have to either try renaming the malwarebytes file as ieexplorer.exe or some such name or fixing your registry ( a system restore to before the virus appeared may or may not work).
1/15/2012 12:00:26 PM EDT
[#13]
Also if you can download Rkill and run it.  And then you can run malewarebytes.
1/15/2012 12:01:54 PM EDT
[#14]
I cleaned that one recently.

It stopped all exe's, I had to to run rkill.com for it to finally run and then combofix took care of it.
1/15/2012 12:05:24 PM EDT
[#15]
restore system to before date?
1/15/2012 12:08:03 PM EDT
[#16]
Try this:
1-go to task manager and kill process. should be 3 letter.exe (ie..pnb.exe)
2-go to search and look for above file. make sure you search in hidden files. once found delete it
3-now run malwarebytes or similar to clean PC.
4-reboot your PC.
1/15/2012 12:13:37 PM EDT
[#17]
combofix
1/15/2012 1:51:29 PM EDT
[#18]



Quoted:


Also if you can download Rkill and run it.  And then you can run malewarebytes.


Yep, that fixed it.



 
1/15/2012 1:56:24 PM EDT
[#19]
Quoted:

Quoted:
Also if you can download Rkill and run it.  And then you can run malewarebytes.

Yep, that fixed it.
 


somebodys gettin lucky tonight....