Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

My parents computer have apparently contracted a virus named "System Fix"

I have diagnosed this from examination of the infected system, and Googling the hilariously alarming fake error messages. This is also hiding the 'stolen' start menu and desktop files in the same place.

This virus slipped right past AVG free edition.

All the sites found with google recommend "Malwerebytes" to remove it, but this ran a full system scan, and did not remove the evil.

What is this thing? How did it dodge two AV programs?

How do I remove this it?

share|improve this question

marked as duplicate by Moab, Dave M, Nifle, Ƭᴇcʜιᴇ007, ChrisF Nov 23 '11 at 21:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
See the System Fix removal guide on this page...bleepingcomputer.com/virus-removal/remove-system-fix –  Moab Nov 22 '11 at 16:55
    
@Moab I found that before I came here. It doesn't work. –  Matthew Scouten Nov 28 '11 at 20:22
    
see this...superuser.com/questions/100360/… –  Moab Nov 29 '11 at 15:14

2 Answers 2

EDIT/ADDITION: Follow all directions below and / or visit this site.

I'll start with some general info on the virus. Then I'll get into how to take care of it.

This virus will start first before any other application and it changes the start-up items so that you won't have any chance in stopping it from running. All the exe installed won't run until you block the virus and that means that you might not be able to download the required virus removers and that is why you might be forced to use another computer and after that move them using a USB drive. You will learn more about this when we reach the removal guide. Also, this virus will change the hidden options of your files and folders and it does it to make you think that there is something wrong with your computer and in order to restore the default settings you need to read the removal guide as the instructions on how to do that are listed at the end of it and it work only if you first remove the infection.

Also, is it likely that System Fix installed another infection, a TDSS Rookit or Google redirect, that redirects all your web searches and so it prevents you from finding any legit malware removal guide and instructions on how to block the virus. However, if you found this post it means that you have managed to find a way around the infection and now you can start removing it. The virus removal guides contains instructions on how to remove the System Fix virus and that rootkit, but before we can move on to the first step we need to correctly prepare your computer in order to make sure that all the infected files will be successfully removed. First you need to read the preparation guide and only afterwards you should move to the first step of the virus removal process.

Prepare your computer for the System Fix removal process

In older to make sure that all the infections will be removed, you need to read the following instructions as you might need to use them:

  • the guide listed here should be printed out because at some point you might be asked to close all the opened screens and running applications, because there shouldn't be any other program that could interfere with the removal process and so we will make sure that all the infections will be successfully removed.

  • System Fix might have blocked the download functions of your system and that means that you need another computer to download the required virus removers. When the downloads are complete, find a USB flash drive and transfer the applications into the infected computer.

  • also, the steps listed in the virus removal guide might need to be performed in Safe Mode with Networking and if you wish to learn how to do that, then you should follow this link and in that virus removal guide you will learn how to boot the computer in Safe Mode.

That's all that you need to do before starting to remove the infections and now we can move on to the virus removal guide and hopefully when you reach the final step all the infected files were successfully removed allowing you to use a virus-free computer. Here's what you need to do in order to uninstall System Fix.

How to remove the System Fix virus using Rkill and Malwarebytes'

Now that you know all that there is to know about this virus, we can move on to the first step of the virus removal guide and please make sure that you don't skip any step. Here's how to remove this malware program from your computer:

  1. Rkill.com is the first application that we will use and with it you will block the System Fix from running. Download Link. Put the Rkill icon on the infected computer desktop screen.

  2. Launch Rkill and wait until it all the fake alerts and warnings are closed. In case System Fix starts to show other errors, you need to continue to launch RKill until the virus is by-passed and only then you can move on to the next step. If you notice that Rkill struggles to complete its task, then you should to use eXplorer.exe or iExplorer.exe and these two Rkill clones will surely disable the malware program. When that happens continue with the rest of virus removal steps without restarting the computer, because if you do that, the virus will be enabled again and then you will have to repeat all steps.

  3. Now we have to scan and remove the TDSS rootkit infection, but this only if your PC features it and in order to be sure you need to follow the instructions on How to remove Google redirects or TDSS rookit. When you finish applying that steps, return to this removal guide and continue with the rest of the virus removal guide.

  4. Malwarebytes' Anti-Malware is the application that we need to use in order to remove all infections. Download Link for MBAM. Place the setup installer of this application on your computer's desktop. Now close all running programs.

  5. Launch the Malwarebytes' installer and complete the installation without changing any of its default settings. The only thing that you need to consider is that the options listed at the final installation screen are both checked, so that MBAM will launch an automatic update and then launch its main interface automatically. Click Finish.

  6. Wait for MBAM to complete the update process and then it will load the Scanner menu. Select the 'Perform Full Scan' and then press the 'Start Scan' button.

  7. Now wait for the scan to be completed and when that happens MBAM will display a confirmation dialog. The Scanner menu will be launched again.

  8. Click on 'Show Results' and then select all the found infections for removal, then click on 'Remove Selected' and wait for the virus removal process to finish. Please note that Malwarebytes' might ask you to restart the PC, but this is optional because either answer will lead to the same result, the System Fix virus will be removed completely. In case you reboot the computer, Malwarebytes' will continue to remove the infected files and when it is complete you will be shown a log file of the scanning process in Notepad. Review this file and when you're done close it.

  9. Close Malwarebytes' Anti-Malware and that means that all the infections were successfully removed.

  10. Now change the Windows theme background so that the next time Windows resumes desktop, it will load all the icons.

  11. The last thing that you need to perform is to restore the Folder Options back to its default values and in order to that we will need Unhide.exe - download link.

    • download Unhide .exe

    • launch it and then allows it to perform all changes needed to restore all the hidden files and folders back to visible again.

    • note that this tool will make all the Windows files visible and, in order to hide all the files that were hidden prior to infection you need to find all of them and manually set their settings to 'hidden'

In order to make sure that all the infections were removed, you should restart the PC and then start Malwarebytes' scan and if it comes back with other infected files then remove them. However, if the virus wasn't removed, then you should perform all the above steps in Safe Mode with Networking and that will surely help you delete and remove all the System Fix malware files.

Now that your computer isn't infected you need to start looking for a powerful anti-malware application and if you don't know which one to choose then I recommend you to upgrade Malwarebytes' Anti-Malware to PRO version and then your PC will be protected against the the worst virus infections. If you have any other questions or concerns, please feel free to post them in the comments fields, displayed at the bottom of this web page.

share|improve this answer
1  
See, I found all that online. I followed all these directions. Malwarebytes DID NOT find or remove the virus. Your recommendation of Malwarebytes PRO, which I never heard of before this incident, makes me wonder if the last paragraph was cut and pasted from their advertising copy. –  Matthew Scouten Nov 22 '11 at 15:42
    
Did you follow all the directions I laid out? –  wizlog Nov 22 '11 at 20:59
1  
Yes. I did them all. TDSS found nothing. Neither did Malwarebytes. I eventually tracked down an deleted the executable. Restoring to an earlier system restore point seemed to undo most of the damage. But this MBAM did nothing at all. –  Matthew Scouten Nov 28 '11 at 20:19

I would suggest you first run TDSSKILLER, download it on a flash drive on another PC or if possible on the same computer and see if the computer is infected with MBR Virus. After that, download Malwarebytes AntiMalware, it should remove it.

http://support.kaspersky.com/downloads/utils/tdsskiller.zip

http://www.malwarebytes.org

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.