2

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Hi! Last night I got infected with the "System Tool" virus. For those who don't know it disallows the user from executing any software, changes the desktop, stops all security software from running, and continually requests that you buy a Trojan security software.

It took me a few hours but I finally managed to remove the software. To do this I went into my Ubuntu partition and searched out files that had been created around the time that I got infected and deleted the executable. Then I went back into my W7 partition and ran an MBAM full scan, an MSE full scan, an AVG bootable USB scan, and ran a ClamAV scan from my Ubuntu partition (Together these found 3 more infected executables). I also ran a Ccleaner full sweep and the registry cleaner just in case.

I think I have found all of the problems but am still concerned that there might be a payload leftover from the virus that I didn't find. Do you have any suggestions of what else I can do to be sure. Just FYI I use W7 64 bit and MSE as my primary antivirus. I was using chrome when I got infected and it seems that it was due to a slightly out of date Java installation (MSE gave me a warning that the website had used a Java exploit and then my desktop changed to the classic "System Tools" desktop) Thank you very much for your help.

Improve this question
1
  • I disagree that this question is an exact duplicate. My question is referring to a specific virus, OS, OS version, and security software. The other question is about malware in general. And I am getting answers that are tailored to this virus.
    – user63299
    Jan 16, 2011 at 15:56

4 Answers 4

Reset to default
0

I had the same thing happen to a customer a month ago - it was a bear to get rid of it - in addition to the tools you used to get rid of it I also ran the Trend Micro scan and this from Kaspersky - once I thought I had the machine clean I ran it through a dozen reboot cycles and located a couple more places it was hiding - in particular it buried itself in the restore points so you will want to clear the Restore Point repository. Apparently one of its hiding places is in a "deleted" file that it "recovers" so defraging the disk got rid of one of its reoccurances.

Improve this answer
2
  • How did you know that it was completely gone? I have rebooted the computer a bunch and it hasn't shown up again yet but I'm still concerned.
    – user63299
    Jan 16, 2011 at 0:15
  • Your thing from Kaspersky found 1 infected
    – user63299
    Jan 16, 2011 at 0:28
1
Improve this answer
1
  • spybot found 2 tracking cookies, others found nothing. thanks!
    – user63299
    Jan 16, 2011 at 0:48
0

how about using the free on-line tool from Kaspersky to scan your computer and remove any virus

http://usa.kaspersky.com/downloads/free-anti-virus-scan

Improve this answer
0

Follow the order given below to properly disinfect your PC

1.) Make a boot AV disc then boot from the disc and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

2.) Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Improve this answer