Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question already has an answer here:

and given itself inherited permissions. At the same time, the former owner of PC, myself, and the admin account created under my name is denied any services that have apparently been installed by virus. How can I either remove the admin accounts that are infected or change the permissions enough to make them harmless. The real pain is the the "inherited permissions" the hijacked admin account has given itself. As a result, any files that I can delete are replaced.

I'm not sure how I got this virus but it is more powerful than anything I've encountered. It has redirected my LAN from the settings with which it was installed to a wireless connection my PC simply terms "Home 26". Ironically, these problems seemed to occur just after signing an annual contract with a PC support service named PCeSupport. Every attempt they have tried seemed jerry-rigged as the same problems would re-appear-more virulently-48 hours after their remote "fixing of issue. (They charged me $400+ for an annual service for 3 PCs and have refused to refund any of it). I have run every anti-virus program I can think of at the problem including: malware anti-malwarebytes, Comodo, Norton 360 and many others. It has disabled two backup two failsafe programs installed, Ghost and Acronis.

I am currently trying to change the user account privileges within the registry but I am on unfamiliar ground. Any help greatly appreciated.

share|improve this question

marked as duplicate by James, Kevin Panko, Moses, Mokubai, Shekhar Nov 30 '13 at 16:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
1- dont touch the hard drive contents from the infected OS. 2 - get a linux bootable CD or USB 3- get an external storage device, or use a network storage 4- backup important data 5- format and start anew. note: it seems to me you are being scammed, but HEY! im no lawyer and only speak crap, so dont take my word on this. –  Lorenzo Von Matterhorn May 1 '13 at 1:31
1  
note 2: malware infected systems are compromised in the future even if cleaned bright. you will eventually have to format or re-image it. –  Lorenzo Von Matterhorn May 1 '13 at 1:33
3  
Its very likely you have fallen for one of the many PCM support scams that exist. At this point a nuke from orbit is a valid solution. The wireless connection statements make little sense. Issue a charge back of you used a credit card otherwise contact your bank for options. –  Ramhound May 1 '13 at 1:36
    
FWIW, malware runs with the same permissions as the user account which launched it, so it didn't inherit admin permissions, it already had admin permissions. Did PCesupport "attempt" to fix your machine remotely or on-site? Also, your post shows your user still has administrative privileges because you are able to install/run antivirus software, what "services" won't it (the virus) let you see? –  packets May 1 '13 at 10:03
    
When you say you've run every anti-virus program, have you tried a Live-CD solutions (e.g., F-Secure Rescue CD, Bitdefender QuickScan, etc.) –  packets May 1 '13 at 10:03

1 Answer 1

Like the comments say above:

  1. Back up important documents from a linux live disk AND SCAN THEM. Do not just put them onto another computer running windows.
  2. Sounds like a nasty bug, I would killdisk (probably overkill, a full format should work just as well) the drive
  3. Reinstall windows
  4. My suggestion: ditch the support service.

Sounds like this is your only option with the way the bug is rooted into your system.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.