computer help needed, where the guru?

[Red_Alert]

Holy shit.

How long have you been getting that?

 

[cane_man]

had 1 more, but it wont upload. malware byts full scan came up empty too

 

[cane_man]

started around noon

 

[Jack_John_Mark]

This worked for me once......

Open up notepad, center it right in the middle of your screen, and then type "I know who you are you skinny fucking little queer four-eyed son of a bitch, and now you're going to get fucked."

 

[cane_man]

and its all from "vista antimalware" if you check the IP of the attack I bet it comes back bs, all the rest have. plus my proxy server is supposed to switch IPs every 30 minutes so i find highly suspect that this could go on all day.

 

[Red_Alert]

started around noon

Do a System Restore back to yesterday. If it'll let you. It only takes a couple of minutes.

Have you created any documents or anything you care to save since yesterday?

 

[cane_man]

Do a System Restore back to yesterday. If it'll let you. It only takes a couple of minutes.

Have you created any documents or anything you care to save since yesterday?

nah. brb, Ill give it a shot

 

[Ghost In The Machine]

I find it hard to believe that those Vista messages are real. It's just trying to get you to click on the free virus scan.

 

[Ghost In The Machine]

Check this out...

Remove Vista Internet Security 2010 fake antispyware | Guidelines to Remove Malware


Here's a forum where some are discussing your problem...

http://www.bleepingcomputer.com/forums/topic295207.html

 

[ccpmotox]

AVG is garbage anti virus program. Just get windows 7 Your PC simplified.

 

[Ghost In The Machine]

XP Internet Security 2010 rogue | Symantec Connect

^^^ I would go with the symantec.com advice before the others.

 

[Red_Alert]

I find it hard to believe that those Vista messages are real. It's just trying to get you to click on the free virus scan.

They are viral. They write themselves into your registry when you click anywhere inside the box on the first pop-up. Once they are written into your registry they commonly disable your antivirus and malwarebytes programs. Sometimes it'll even prevent you from restoring back a day or two.

If it does that he needs to bring his computer up in safe mode first. Then run malwarebytes.

 

[Ghost In The Machine]

From the symantec forum that I linked to...

"While searching the web for iPhones, a fake security malware infected my laptop. Although I use Firefox and Symantec Endpoint, the trojan slipped through my XP SP3 system. When I ran a full scan, the March 5 r of Symantec did not identify the problem. After researching the web, I found a blog at "Bleepingcomputer.com," which fully described the problem and the solution. I used MalwareBytes' AntiMalware to remove the infected registries and files. Note that the rogue has other names, such as Vista Internet Security 2010, Win 7 Internet Security 2010, and several others. This rogue must be disabled before it allows other executable files to run. I used FixExe.reg.

Variants of the files infected are as follows.

%UserProfile%\Local Settings\Application Data\av.exe

%UserProfile%\Local Settings\Application Data\WRblt8464P

%UserProfile%\AppData\Local\av.exe <In Antivirus Vista 2010 & Win 7 Antispyware 2010>

%UserProfile%\AppData\Local\WRblt8464P <In Antivirus Vista 2010 & Win 7 Antispyware 2010>

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*

HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*

HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*

HKEY_CLASSES_ROOT\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"

My system had the "av.exe" rogue and six infected registry files.

Any questions, please reference the article posted Jan 27, 2010 by Grinler on BleepingComputer.com "How to remove XP Internet Security 2010, Antivirus Vista 2010, and Win 7 Antispyware 2010."
I also found an older article at Rogue Security Software | Fake Virus Alerts | Scareware

 

[Red_Alert]

He's already run the quick and full versions of Malwarebytes.

The virus is overriding them.

If restoring to yesterday doesn't work, he needs to run Malwarebytes in 'Safe Mode".

The virus should be blocked from executing in safe mode, and Malwarebytes can do its job.

 

[cane_man]

fuck. did system restore, it took out my internet, malware bytes and ISO virtual dvd. went back to original settings, got internet back but malware and virtual dvd drive still gone. ran eusing registry cleaner and the problem seems to be gone. except, I keep getting a request for a BHO registry change, and it wont let me deny, so I just slide it to the side. will deal with that tommorow. fuck, this is exhausting

 

[Red_Alert]

How far back did you go?

 

[ccpmotox]

fuck. did system restore, it took out my internet, malware bytes and ISO virtual dvd. went back to original settings, got internet back but malware and virtual dvd drive still gone. ran eusing registry cleaner and the problem seems to be gone. except, I keep getting a request for a BHO registry change, and it wont let me deny, so I just slide it to the side. will deal with that tommorow. fuck, this is exhausting

Did you try deleting your system32?

 

[joyner82]

Did you try deleting your system32?

this won't end well

 

[ccpmotox]

this won't end well

WHY DO YOU HAVE TO RUIN EVERYTHING!

 

[Red_Alert]

Did you try deleting your system32?

Don't do that.