Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

My computer is now basically a breeding ground for Trojans. I can't open up Firefox or Opera without getting redirected to some training job site or have a fake Windows XP virus scan screen open up.

I'm typing this on Chrome, which seems fine. I can't install MSE or enable OneCare and can't enable the Security Center.

I ran this: http://www.anti-virus-professional.com/

It found 5 bad files. I manually went to the locations where it detected them and deleted them.

The baddies are still on my computer, though. IS MY BATTLESHIP SUNK?!

share|improve this question

4 Answers

up vote 6 down vote accepted

You have just installed a nice piece of rogue security software.

Follow these instructions to remove the program manually:

How to Remove Anti-Virus Elite

Then download and run MBAM, do a Quick Scan and remove all infections.

Note: it is essential that you disable/remove Anti-Virus Elite first as it will prevent the installation of MBAM!

share|improve this answer
Wow thanks, my father recommended the Anti-Virus Elite thingie, should've known better. :P, Scanning now with MBAM. Thank you so much. – Ben Dec 24 '09 at 23:00
your father did probably pay them and was delighted how the annoyances came to an end. that's they these rogue programs work. – Molly7244 Dec 25 '09 at 12:55
up vote 2 down vote

Nuke it from orbit, it's the only way to be sure ;). Alternately I'd suggest running an offline AV scan off a CD, or UNetbootin. Avira has a CD, and UNetbootin has a variety. Bypassing the AV means a better chance of detecting well hidden viruses. Once this is done, the usual Malwarebytes/AV technique should be done, following which if anything is broken, running sfc /scannow or doing a repair install might be needed.

share|improve this answer
Thank you, this is very interesting. – Ben Dec 25 '09 at 1:55
up vote 0 down vote

First off, I've never even heard of that anti-virus program. I'd recommend Avira as it is an excellent and trusted free AV solution. But if you're computer is riddled with as many trojans as you say it is, maybe a full reformat would be better for you. Reformatting is typically faster to have you up and running virus free, assuming you have the drivers and applications ready to reinstall. A scan can take a few minutes up to a few hours depending on how much your system has been bogged down. A fresh Windows installation usually takes less than an hour. Back up any files you want to keep before doing anything drastic.

share|improve this answer
"Reformatting is typically faster to have you up and running" ... maybe for us who have a nice variety of Ghost images to choose from. :) – Molly7244 Dec 24 '09 at 22:53
Well thats even faster. But all you need is your windows disc and your drivers and necessary programs. – John T Dec 24 '09 at 22:56
Thanks for your advice. I have a large harddrive with a lot of media and numerous programs, reformatting is not practical at the moment. But I'm downloading Avira, at this point the more real AV the merrier, lol. – Ben Dec 24 '09 at 22:57
Remove antivirus elite first and foremost though. – John T Dec 24 '09 at 22:58
up vote 0 down vote

First thing I recommend is that you download: (1, 2 and 3 if you are an expert, 2 and 3 if you are an average user)

  1. Autoruns

  2. Microsoft Security Essentials

  3. Spybot Search and Destroy. (Also, from download page, get the latest definitions)

Now, keep all these files in a directory or on a USB stick.

Look at your hosts file - c:\windows\system32\drivers\etc\hosts and make sure there are only one or two entries for localhost, or if there are more and you know why, leave it.

**(If using internet explorer) ** Next, go to internet options and in the last tab, click Reset under Reset Internet Explorer Settings. This should remove all toolbars and any "bad" settings.

Boot in to safe mode and install Spybot Search And Destroy, let it run and remove all the rubbish.

Next, install Microsoft Security Essentials.

Lastly, if you think you know what you are doing, use Autoruns and check Windows Startup and get rid of all the extra entries (if there are any... or just give your computer a spring clean).

share|improve this answer
you can disable it all you want with Autoruns, it does come back immediately, Microsoft Security Essentials will not even pick it up and Spybot S&D will suffer the same fate as MBAM, Anti-Virus Elite will prevent the installation (even in safe mode) ... unless you kill the processes, unregister the DLLs and and delete the registry key. – Molly7244 Dec 24 '09 at 23:01
... I have used Autoruns for years for this situation and even skipping out safe mode, it is better than many AV scanners... and I suggested the order above that Autoruns should be run last... I have done this order for many years without any problems. – William Hilsum Dec 24 '09 at 23:17
well, not the security essentials, used to be AVG or Nod32, but it still works! – William Hilsum Dec 24 '09 at 23:18
yep, Autoruns is a killer, however, you'll have to kill more than just the one obvious entry, and without exactly knowing which files you're looking for it's a bit of a challenge. :) – Molly7244 Dec 24 '09 at 23:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.