Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

UPDATE

I've posted my solution below.


This thing popped up on the computer of one of my employees on Friday. I've spent most of the weekend scanning the computer with Avira AntiVir, Avira Boot Sector Repair Tool, Kaspersky Virus Removal Tool, Malwarebytes, Spybot, McAfee Stinger, and something else I forgot and all of them found something. Overall they all cleaned about 400 malicious items, except for this one.

This screen shows up right after the computer boots up and the user logs in. There's a slight lag while the OS is loading the profile and after that this pops up. I think it's something along the lines of a browser hack because I saw Firefox (3.6.18 I think) start up right before it appeared.

I can do CTRL+ALT+DEL and bring up Task Manager, but as soon as I do the virus screen overlays it.

What is this virus and how can I get rid of it?

enter image description here

share|improve this question

migrated from serverfault.com Aug 22 '11 at 6:09

This question came from our site for professional system and network administrators.

    
Call in the Allied nations. Sorry, had to say it. :) –  Keltari Aug 22 '11 at 6:36
2  
Take a look at our community guide and see if the steps there help you: What to do if my computer is infected by a virus or a malware? –  slhck Aug 22 '11 at 8:10

6 Answers 6

As it's been said over and over again, the only sure-fire way to ensure that a virus is gone is to format your computer, and re-install things one by one.

That said, this isn't technically a virus, but a new kind of malware that makes you pay to remove it, which you should not do under any circumstances, because you're contributing to organised crime.

share|improve this answer
    
Yes, I realize all of that already. The problem is that I wasn't the one who set up this computer and backing it up, reformatting it and re-installing all of the software is an absolute last option. I'm looking for suggestions or tools that I haven't tried before to remove the malicious software that's causing that screen to appear. –  Alex Aug 22 '11 at 6:15
    
If you pay to remove it, they'll usually have something else waiting to take its place (and then you'll have to pay to remove it too, ad infinitum). Then, to add insult to injury, there's all the credit card fraud that usually follows the first payment as well -- the entire business model is based solely on "take the money and run." =( –  Randolf Richardson Aug 22 '11 at 6:24
1  
You cannot trust this pc anymore, time to format it. –  ZippyV Aug 22 '11 at 7:44
2  
@Alex, unfortunately your "last option" is the first one that is guaranteed to work. Once a computer is rooted like this it isn't your computer any more and there's only one way to be sure that you've got control of it again and that's to wipe it (backup date only first if needs be, of course). –  RobM Aug 22 '11 at 7:45
    
I'd also note that in your steps listed @Alex you wouldn't back it up now. You'd back up the malware as well. The backups should have been done beforehand...otherwise, just format and re-install. You could try jumping through hoops to just get data files (documents), but you would not want any applications/executables/etc. but at this point I'm not sure I'd recommend it. –  Bart Silverstrim Aug 22 '11 at 10:41

This seems to be a brand new scareware. As far as I see, it has not been described by the antivirus specialists yet. It threatens to delete the contents of the disk and sue you for using an illegal copy of Windows.

I propose you turn off the infected computer, remove the disk and copy the contents of the disk to some safe spot. Then you can also retry a virusscan while attached to a different computer (not booting this infected disk).

Personally, I would backup the data and go for a fresh install. Once a malware was on a windows, there is no way to make sure all traces have been removed, because once they have a hold of your computer they will continue to try and use it / your data / your bank account. In cases like this, it seems to be usual to load more malware onto the computer.

Users of this computer should change their passwords, if banking has been done, check their bank accounts and set a new PIN.

Oh, and dont pay. If you do, it might ask for admin permissions to "fix" your windows, and then rootkit you for good.

share|improve this answer
    
Yeah, I can't read that, but it's all the same... I used the UBCD 3.60 to scan it and then when that wasn't getting anywhere I plugged it into my desktop and scanned it again with other tools. I really don't like having to go down the path of reformatting... –  Alex Aug 22 '11 at 6:34
    
As far as I can see, the scareware is just too new or too rare to be recognized by antivirus yet. –  Posipiet Aug 22 '11 at 6:36

How much time have you spent already trying to fix the PC?

You may just find that booting with something like an Ubuntu live CD to copy all data to a removable USB hard drive, then formatting the disk and re-installing is actually the fastest way to solve this problem.

I've seen it happen time and time again where so many more hours are spent trying to remove viruses or malware than what it takes to simply backup, format and re-install.

I know you don't want to do this, you would rather use a tool to fix the problem, but I think you'll save time by doing a clean install and you'll also know that the malware is really gone.

You computer will probably run faster as well as this is usually the case on a fresh install.

share|improve this answer

It seems to be the BKA Trojan (the first couple of results are links to the scareware’s site, so don’t use those). It seems that the consensus is to either reinstall, or use more anti-malware software.

Re-installing should be a last resort; trying to remove it is better. The worst that can happen is that you end up re-installing anyway and “waste” some time learning some stuff.

It may seem silly/obvious, but have you tried pressing Alt+F4 on the window?


I can suggest trying a few more softwares to try (run them in safe-mode to for better results):

  • SUPERAntiSpyware (use the portable version)
  • Autoruns (to weed out where it is running from)
  • HijackThis (to analyze the system fairly throughly)
  • WinSpy++ (to remove the topmost attribute from the window, though it may reset it every couple of seconds)
  • ComboFix (scorched-Earth last resort)


Another thing to try is to quickly look in the Task Manager’s Processes tab to try to figure out which process(es) the trojan is running from, and try to kill it (you don’t need to see it the Task Manager to kill it, you can type out the first several letters of the EXE name, and press Del, then Space), though make sure that the Task Manager’s Always-On-Top option is selected; just in case.


(Side note: I find it amusing that the trojan is using the Windows 7 logo even though the Alex has indicated that it is an XP system. sigh)

share|improve this answer
    
Technically the worst that can happen is that there are replaced system binaries that continue to download and install backdoors and capture keystrokes to steal passwords, upload them to another site, then have identity theft problems. A compromised system can lie when you run binaries and booting from a disc means trusting that it has signatures up to date enough to catch the latest malware, which it might not. –  Bart Silverstrim Aug 22 '11 at 10:45
    
@Synetech, I laughed at the logo as well. I haven't tried the ALT+F4 yet. And I forgot to mention that it shows up in safe-mode as well. I'll give these a shot when I can setup the PC again. –  Alex Aug 22 '11 at 15:42

Most, but not all, malware can be manually removed with autoruns.

Try the following procedure:

  • download autoruns from the above link and run it straight from the zip archive
  • let it scan (if it can)
  • look for two types of entries - ones with no signature and more importantly entries which say 'file not found'. The second kind is typical for viruses that insert themselves into various parts of the system that get executed during start time (but upon startup they temporarily remove the infected file and make it accessible only on the next restart). By unticking the problematic/suspicious entries you can cripple the malware to the point that it will not be active in the system anymore (and if you untick something that is needed you can always tick it back on).

Now, if you can not run autoruns that would be due to the virus already blocking it - however viruses will rarely do that.

This procedure is surprisingly efficient, but of course this is only due to viruses not targeting it. You can always try it.

After going through it you can use

  • process explorer to check if there are strange processes running on you system
  • tcpview to audit and monitor your network activity

Using these tools is not trivial (does require knowledge of the normal system behavior), but in case that

  • the regular anti-virus software does not recognize the threat yet neither will booting to linux and trying to clean with clamav
  • you really want to try to clean it and try to avoid re-format

you can try to follow the procedure I gave.

share|improve this answer
up vote 2 down vote accepted

So, after spending several days fighting this thing, I finally got rid of it. I'm pretty sure I got the right one, but along the way I found some suspicious items that could have contributed. Here's the steps it took to clean it up.

First thing I did was to check all of the autostart locations on windows. I followed this article here. Most of the locations where clean except for:

  1. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
    • This key had a second path on it pointing to C:\Documents and Settings\NetworkService\Application Data\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe
  2. HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    • This node had a REG_SZ key named 2C508BD5-F9C6-4955-B93A-09B835EC3C64 which was pointing to the msvcs.exe file in the Userinit key.
  3. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    • This node had two other nodes that looked suspicious to me. They were named \toldvw32 and torlfsvses. Both nodes had keys that pointed to a toldvw32.dll file and were set with a WlStartupEvent event. Looking these up on Google didn't produce any meaningful results at the time, so I went ahead an removed them. There doesn't seem to be problems with having done that yet.

The real issue is that msvcs.exe file. If one manages to survive it will replicate it self across all user profiles on the machine. Since it was hooked up into the NetworkService profile it would always make sure it existed in the other profiles.

There's three locations where msvcs.exe exists. They are:

  1. {PROFILE}/Application Data/09A52917-B4FC-4f02-AE3B-BF55D9351F4A
  2. {PROFILE}/Start Menu/Programs/Startup
  3. WINDOWS\Prefetch
    • Not 100% sure on this one, but I did find two suspicious files: MSVCS.EXE-0CA809BA.pf and MSVCS.EXE-301B4EC0.pf. I went ahead and removed them without issues (so far at-least).

I hope this helps someone in the future. It worked for me. If you have a computer that had/has this and it's hooked up to a domain make sure to check the user's profile folder on the server as well, there's a copy there too. Needless to say, don't login into that profile directly on the server because you're just going to have a very fun time after that...

Also, you can't clean it through Safe Mode if the profile you're logging into has been infected. I used UBCD4Win to clean up what I saw, then I did the rest through Safe Mode.

Now, I know the general consensus is to nuke the computer and start from scratch, but that is not always possible in a business environment. After I had it cleaned up and confirmed clean by several antivirus tools I ran chkdsk /f /r on the drive, defragmented it with MyDefrag (4.3.1) and the computer works perfectly as if it never happened. So, nuking the computer is not always the best course of action as @Synetech pointed out him/her self.

Lastly, Kaspersky was installed on the computer, but somehow was turned off and that's how the virus (malware?) got through and did what it did. I'm not a fan of antivirus software at all, in fact I don't have any on my 6 or so machines that I have, but in an environment where you have technically challenged personel, it is a good idea to have it and its also a very good idea to make sure it's actually turned on and updated.

That is all fellow awesome people. I hope someone else can benefit from this answer in the future.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.