Wife's Laptop Compromised

Curiosity · **Posted:** Mon Oct 25, 2010 0:25

Chaps and chapesses.

The wife's laptop appears to have become compromised by a fake antivirus program.

Anyone know how to get rid of the thing? I've considered rolling back to a previous thingy or something, but by this use of language you can tell I'm blundering in the dark. I've downloaded TDSSKiller from Kaspersky as I heard that might have been the right thing, but it didn't help and found no baddies to delete. It's clearly a scamming annoying virus/trojan thing. Can someone with some sense for these things please help me?

I'm attaching two screenshots from the laptop, taken via my phone. The first shows the fake alert message and the second the name of the shitty product that they want us to pay for to protect us from their own virus ("Antivirus safebrowser").

Can anyone assist?

Mr Dave · **Posted:** Mon Oct 25, 2010 0:27

Nuke it from orbitDrop it on a marble tv stand and restore backup. You can't really trust it now.

LewieP · **Joined:** 29th Apr, 2008 **Posts:** 7600

I'd be doing a complete reinstall to be honest.

You could try Microsoft Security Essentials though, it's pretty good.

devilman · **Posted:** Mon Oct 25, 2010 0:36

I'd give Spybot Search and Destroy a go, personally.

GovernmentYard · **Joined:** 30th Mar, 2008 **Posts:** 5318

I had this, took ages to get it into safemode and then delete using malwarebytes sugfficient of the crap it sets running to allow me to back up a few irreplaceable files and then I had to do a full wipe and reinstall. Spent a few days trying to beat it as I recall, threw all decent software at it and no luck, however I didn't have microsoft security essentials then. I do now, as I was rocking spybot and Avira at the time and a fat lot of good they did me.

JohnCoffey · **Posted:** Mon Oct 25, 2010 2:01

LewieP wrote:

I'd be doing a complete reinstall to be honest.

You could try Microsoft Security Essentials though, it's pretty good.

http://www.overclock3d.net/news/tools_d ... sentials/1

Quote:

Microsoft’s free antimalware program – Microsoft Security Essentials has fallen prey to an ingenious new malware threat. Masquerading as Microsoft Security Essentials, the new malware attack gets into users computers through a drive-by download.

Identified by security software major F-Secure as Trojan.Generic.KDV.47643, the new threat presents itself as a benign hotfix.exe or mstsc.exe file. As explained on the F-Secure blog, there is no open threat so most users accept and install the malware, which then shows itself off as Microsoft Security Essentials complete with the blue fortified castle icon of the brand.

Once installed, it starts shooting out a long list of malware threats that have been detected on the system. It also lists most top ranked antimalware software programs including Trend Micro, Panda, and Symantec, but shows these as incapable of removing these latest and most severe infections.

Not surprisingly, the fake alert suggests similarly fake antimalware products for removal of the threat. These include AntiSpySafeguard, Major Defense Kit, Peak Protection, Pest Detector, and Red Cross. None of these products actually exist in the market.

According to the F-Secure blog, the attackers behind the new malware are hoping to dupe naïve users into agreeing to purchase one of these special but rogue antimalware products and thereby give them back door access into their systems and personal / financial information. The biggest give away for this fake threat is that while it is masquerading as Microsoft Security Essentials and detecting malware threats, it is asking users to purchase another antimalware program for their removal.

The F-Secure blog also went on the clear the air about Microsoft Security Essentials, which it has described as a genuine, free and effective antimalware program that can be trusted, but only if it has been downloaded from the Microsoft website or its authorized download partners.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38646

If you still have access to a desktop PC then this is an excellent tool

http://www.avg.com/ie-en/avg-rescue-cd

It's a bootable CD image that will scan and zap anything it can. If it can get online it'll update itself too.

Grim... · **Posted:** Mon Oct 25, 2010 9:08

JohnCoffey wrote:

LewieP wrote:

I'd be doing a complete reinstall to be honest.

You could try Microsoft Security Essentials though, it's pretty good.

http://www.overclock3d.net/news/tools_d ... sentials/1

Did you not read what you linked to?

Curio: Wipe it, re-install it.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

kalmar · **Posted:** Mon Oct 25, 2010 9:43

Mr Dave wrote:

Nuke it from orbitDrop it on a marble tv stand

Glad someone said it

Yes, I'm in the "nuke it" camp as well, had to do so recently on my parents PC. Windows restore options usually retain all your files but you'd be well advised to back everything up first - use a knoppix boot cd to copy to a plug in drive for example.

Curiosity · **Posted:** Mon Oct 25, 2010 10:05

Doctor Glyndwr wrote:

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

*mumbles under breath*

How do I do that?

Grim... · **Posted:** Mon Oct 25, 2010 10:06

Copy all the documents you want onto a USB stick or external HDD or something.
Put the Windows CD in, format the drive, then re-install.

On the plus side, this should make it go faster.

markg · **Joined:** 30th Mar, 2008 **Posts:** 16629

That's if he even has a windows disk, most laptops come with a recovery disk or even a recovery partition on the HDD.

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14514

Curiosity wrote:

Doctor Glyndwr wrote:

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

*mumbles under breath*

How do I do that?

Read the instructions which came with it - typically the machine will either have a recovery disk (boot from it and follow the prompts to wipe everything) , or have a special partition setup for that (boot and press a magic key combination to access the recovery partition).

If not you'll need a set of drivers for the machine and a windows disk for whatever flavour you've got.

(BTW I agree with the other comments on here - unless there is something on there you cant live without nuke it - you can 'clean' the current infection but you should have no confidence in the integrity of the machine beyond this point)

Zio · **Joined:** 31st Mar, 2008 **Posts:** 6093

Grim... wrote:

Copy all the documents you want onto a USB stick or external HDD or something.
Put the Windows CD in, format the drive, then re-install.

On the plus side, this should make it go faster.

Only thing I'd add to this is to check first to see if the laptop has some kind of factory settings reinstall option first, as most modern laptops do. This would be by far the simplest method of getting the laptop up and running again and should still have the desired 'nuke it' effect.

Being a bit old school in my Windows experience, I decided to reinstall my Alienware laptop using the bundled Windows 7 reinstall CD before selling it on eBay, only to discover that the bundled app and driver reinstall disc was less than extensive. Or especially useable. So I figured I'd go for the factory reinstall option instead, only now it turns out that even though the reinstall partition is still definitely there on the disc, nuking Windows has made it utterly unusable. I phoned Dell and, according to them, this is "tough shit"*. Downloading all the drivers and having to reacquire the bundled wallpapers and avatars and the like from less reputable sources to get the thing back to factory default standard was a right fucking ballache, and I pity the poor sod who has to reinstall it next time.

*may not have been actual words used.

Alarm · **Posted:** Mon Oct 25, 2010 10:34

I had a similar thingy on my craptop. I used CCleaner to locate where the program was launching from when the PC starts up, deleted that and the program and all its traces (including the registry). The laptop has worked fine since. I guess you need to be a little computer savvy to do that though.

A complete HDD wipe and reinstall is probably better.

Curiosity · **Posted:** Mon Oct 25, 2010 10:56

I shall see if the missus has anything she wants to save, and, perhaps more importantly, any of the stuff the laptop came with.

Should she not have any of these discs or whatnots... what then?

markg · **Joined:** 30th Mar, 2008 **Posts:** 16629

Curiosity wrote:

I shall see if the missus has anything she wants to save, and, perhaps more importantly, any of the stuff the laptop came with.

Should she not have any of these discs or whatnots... what then?

Not sure, there should be a sticker somewhere with a Windows license key on it. I don't know if you could just acquire any old Windows disk and use that license key with it.

Cavey · **Posted:** Mon Oct 25, 2010 11:03

Whilst about as far from being a computer guru as is possible to imagine (LOL) and not to detract from anything far more knowledgable people here have said, how about giving this a quick go before nuking from orbit, Curio:

1. Install, activate and update Kapersky AV software. Once fully updated, disable wireless and any LAN connection etc., switch security settings to max., and all scan settings to look at everything and anything incl hidden files etc.

2. Install, activate and update CCLeaner software mentioned above.

3. Save out any critical documents and images to USB memory stick.

4. Reboot PC in SAFE mode (hit F8 or whatever when laptop is booting up, select 'boot from HD'

5. When booted in up in safe mode, go into Control Panel from Start menu, double click "System", select "System Restore" tab, check "turn off System Restore" box, select "Apply", select "OK" (HDD should then delete all restore files, which will take a while)

6. Run your Kapersky AV software, full system scan, all areas. Neutralise/clean anything found.

7. Run CCLeaner software (when still in SAFE MODE). Neutralise/kill anything found.

8. Reboot PC in normal mode and re-scan it using AV software and CCleaner, hopefully nothing found.

9. Go into Control Panel>System and uncheck system restore disable. Re-enable wireless etc.

Dunno, gotta be worth a shot. Would suggest buying Kapersky and CCleaner from legit sources rather than torrent etc.

Good luck

EDIT: Would deffo recommend using Kapersky and not any other AV software - Norton, McAfee, AVG etc. are shit and don't do what they claim to do on the tin.

JohnCoffey · **Posted:** Mon Oct 25, 2010 11:08

Grim... wrote:

JohnCoffey wrote:

LewieP wrote:

I'd be doing a complete reinstall to be honest.

You could try Microsoft Security Essentials though, it's pretty good.

http://www.overclock3d.net/news/tools_d ... sentials/1

Did you not read what you linked to?

Curio: Wipe it, re-install it.

Yes I just thought it was interesting.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38646

Or you could download this bootable iso, burn it to a cd, boot from it, get rid of the virus and save yourself a shit load of bother.

http://www.avg.com/ie-en/avg-rescue-cd

TheAlbin0Kid · **Posted:** Mon Oct 25, 2010 11:25

I'm amazed nobody here knows of anything you could boot up that will 'zap' the bad files, thought at least one of you IT boffins would have come across something like that...

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Captain Caveman wrote:

Dunno, gotta be worth a shot. Would suggest buying Kapersky and CCleaner from legit sources rather than torrent etc.

TheAlbin0Kid wrote:

I'm amazed nobody here knows of anything you could boot up that will 'zap' the bad files, thought at least one of you IT boffins would have come across something like that...

There's plenty of tools around. The process Cavey describes will certainly claim to give the machine a clean bill of health by the end. But you simply cannot know for sure if there's something lurking undected on a Windows install you'll probably type your credit card number into one day.

When this has happened to my own computers I have always reformatted them and that's always my advice to others. It really is the only way to be sure.

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49244

Doctor Glyndwr wrote:

But you simply cannot know for sure if there's something lurking undected on a Windows install you'll probably type your credit card number into one day.

Well yeah, you can. It just takes a hell of a lot of legwork, and certainly isn't to be recommended for the less tech-literate.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38646

TheAlbin0Kid wrote:

I'm amazed nobody here knows of anything you could boot up that will 'zap' the bad files, thought at least one of you IT boffins would have come across something like that...

I love you.

markg · **Joined:** 30th Mar, 2008 **Posts:** 16629

Doctor Glyndwr wrote:

There's plenty of tools around. The process Cavey describes will certainly claim to give the machine a clean bill of health by the end. But you simply cannot know for sure if there's something lurking undected on a Windows install you'll probably type your credit card number into one day.

When this has happened to my own computers I have always reformatted them and that's always my advice to others. It really is the only way to be sure.

But surely by the same token you are relying on the same sort of software to know that there's not something lurking undetected at any given time.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Craster wrote:

Well yeah, you can. It just takes a hell of a lot of legwork, and certainly isn't to be recommended for the less tech-literate.

Bollocks you can. If it has some new malware no-one's written a scanner for yet and doesn't trip and heuristic scanners, you're fucked. And the black hats out there write an awful lot of new malware each year.

Zardoz · **Posted:** Mon Oct 25, 2010 11:33

Doctor Glyndwr wrote:

There's plenty of tools around.

Too fucking right.

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49244

Of course you can. You just validate that every running process is one that you want running, and that any of the methods of automatically launching processes are sanitised. And use windows file protection to validate that the windows processes that are running aren't modified versions.

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14514

Craster wrote:

Doctor Glyndwr wrote:

But you simply cannot know for sure if there's something lurking undected on a Windows install you'll probably type your credit card number into one day.

Well yeah, you can. It just takes a hell of a lot of legwork, and certainly isn't to be recommended for the less tech-literate.

Correct - most AV companies have a bootable disk which you can use to clean up infections the problem is they only know about the actual infection.

Many bits of malware allow remote access to your machine and the cleanup cant 'undo' whatever the nasty person did while they were on your machine (add extra users / open up ports / install legitimate software to allow remote access again / etc etc) - so if your machine has been compromised the *safest* thing is to wipe it and start again - it may well be quicker to just clean up the infection but you really cant trust the machine 100% again.

JohnCoffey · **Posted:** Mon Oct 25, 2010 11:36

TheAlbin0Kid wrote:

I'm amazed nobody here knows of anything you could boot up that will 'zap' the bad files, thought at least one of you IT boffins would have come across something like that...

It just depends on whether the software companies have written a definition for it.

You can set Avast ! to do a boot time scan, but if it doesn't know what it's looking for it can't remove it.

That's my usual method of fightback. Run an Avast ! boot time scan, kick out what's there and then go into safe mode and run MBAM.

If I'm still wary I just run Acronis and reimage.

itsallwater · **Posted:** Mon Oct 25, 2010 11:37

Doctor Glyndwr wrote:

Craster wrote:

Well yeah, you can. It just takes a hell of a lot of legwork, and certainly isn't to be recommended for the less tech-literate.

Bollocks you can. If it has some new malware no-one's written a scanner for yet and doesn't trip and heuristic scanners, you're fucked. And the black hats out there write an awful lot of new malware each year.

That could happen on any system connected to the internet, mind. But I take your point, at least if it's rebuilt you know that it's probably ok.

itsallwater · **Posted:** Mon Oct 25, 2010 11:40

oh and "Your mums Compromised"

itsallwater · **Posted:** Mon Oct 25, 2010 11:42

I goggled this but I'd only try the manual tasks:

http://www.2-spyware.com/remove-coregua ... owser.html

itsallwater · **Posted:** Mon Oct 25, 2010 11:55

Also I've had a few problems where some of these virus are installed by some horrid kind of self adapting root kits that re-installs itself after cleaning along with other viruses. Very few virus checkers (actually need to look for root kit checkers too) seem to be able to find them even after you cleaned the system.

If after you've cleaned, it as per above, you keep getting virus warnings or other such bollocks it's safer to wipe it and start again as most of the other techniques I've found risk borking it anyway.

Obv avoid placing your bank details onto this machine and back up files to something that you can keep separate from other machine files so you can at least screen them.

ApplePieOfDestiny · **Joined:** 17th Dec, 2008 **Posts:** 8293

I love the concept of Maria restraining herself from putting bank details into something. She was cast in the same mould as the AppleTart.

Mr Dave · **Posted:** Mon Oct 25, 2010 12:14

Curiosity wrote:

Doctor Glyndwr wrote:

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

*mumbles under breath*

How do I do that?

What make/model of laptop is it?

If at all recent, it's probably quite easy.

Curiosity · **Posted:** Mon Oct 25, 2010 20:01

Mr Dave wrote:

Curiosity wrote:

Doctor Glyndwr wrote:

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

*mumbles under breath*

How do I do that?

What make/model of laptop is it?

If at all recent, it's probably quite easy.

It's an HP pavillion dv2500.

I have the Windows Vista product key but no Windows Vista discs that I know of.

Anyone got a disc spare?

DBSnappa · **Posted:** Mon Oct 25, 2010 20:49

Buy a Mac.

HTH HAND

Mr Dave · **Posted:** Mon Oct 25, 2010 20:54

Curiosity wrote:

Mr Dave wrote:

Curiosity wrote:

Doctor Glyndwr wrote:

Grim... wrote:

Curio: Wipe it, re-install it.

The only time that "don't wipe it, fix it instead" is the right answer is if you can be utterly confident it's been totally cleaned up, which is a tall order for an specialist and basically impossible for a layman. Curio, do what Grim... said.

*mumbles under breath*

How do I do that?

What make/model of laptop is it?

If at all recent, it's probably quite easy.

It's an HP pavillion dv2500.

Ok, frst possibility - Start Menu -> All programs -> HP tools -> HP System Recovery (If it doesn't exist check menus for similar things)

Second ppossibility, it may well have come with a recovery partition. F11 May boot from it. Will keep investigating, but it may be worth checking of there's such a partition.

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14514

Also worth checking :

http://h20000.www2.hp.com/bizsupport/Te ... Id=3369414

which if you follow for vista takes you here :

http://h20000.www2.hp.com/bizsupport/Te ... =c00809678

So basically you can create a set of recovery disks then boot from those or press F11 to access the recovery manager (if available)

Zio · **Joined:** 31st Mar, 2008 **Posts:** 6093

Funnily enough I only reinstalled my gf's HP laptop with Windows Vista about a fortnight ago. You don't need the disc, you can boot HP System Recovery by pressing one of the F keys during boot up. It tells you what key to press at the bottom of the BIOS splash screen when you power the machine on.

Edit: And if your wife is anything like my girlfriend, get Microsoft Security Essentials on there and tell her to STOP FUCKING USING LIMEWIRE FFS!

Also, prepare yourself for the Windows Updates. My God, there's a lot of them for Vista!

Curiosity · **Posted:** Tue Oct 26, 2010 13:24

Cheers for the help, guys. I backed up about 10GB of photos last night on to a temperamental hard drive, and will attempt the restore tonight.

Does it take a long time?

kalmar · **Posted:** Tue Oct 26, 2010 13:26

Not really, but as Zio said, getting all the microsoft updates again takes ages!

Zio · **Joined:** 31st Mar, 2008 **Posts:** 6093

kalmar wrote:

Not really, but as Zio said, getting all the microsoft updates again takes ages!

Three nights in a row I'd get home, stick her laptop on and start running Windows Update. Three nights. We have a decent 20MB broadband connection in the flat too!

Grim... · **Posted:** Tue Oct 26, 2010 15:17

Is it Vista, has he said? It might be 7, which is much better.

Zio · **Joined:** 31st Mar, 2008 **Posts:** 6093

Grim... wrote:

Is it Vista, has he said? It might be 7, which is much better.

Curio said earlier that he has a Vista key but no disc, so I'm assuming it must be Vista.

You're right though, 7 is a hell of a lot better.

MrD · **Joined:** 30th Mar, 2008 **Posts:** 2139

Don't forget to change all your passwords 'n' stuff.

Be Excellent To Each Other

Wife's Laptop Compromised
Please help

Who is online

Be Excellent To Each Other

Wife's Laptop Compromised Please help

Who is online

Wife's Laptop Compromised
Please help