3

My sister got one of those fake antivirus trojans on her Vista laptop. It didn't change her background, but pops up "Vista Security Center" BS stuff all over the place and has killed her internet - both IE and Firefox crash when they start up, and if they do stay up there's some DNS redirect or proxy or something saying the computer is infected. Bah!

Normally when I've had to clean these things up I start in Safe Mode, run HijackThis to disable the offending process from starting up automatically and then reboot and run scanners (adaware lately) to clean things up.

This time though, the friggin' thing even runs in safe mode. I'm in safe mode, but after a few seconds the trojan app pops up, and I can't connect to the Internet because of the same proxy junk that it has. Soooooo....my questions:

  1. My plan now I guess is to run a bootable AVG cd and see if that can clean it, but I haven't had luck with that in the past, leading to..

  2. This is now the third infection like this in as many weeks from people I know. All computers were supposedly either running MS Security Essentials or AVG - are those just not catching whatever this is before it does damage and they suck, or is something else going on?

  3. Speaking of AVG, I tried running the bootable CD on another infected computer awhile back and it didn't find anything. It wasn't until I did the hijackthis stuff until I had success cleaning things.

  4. How is this thing running in safe mode even? And how can I disable startup items in that case? I didn't see anything funny when running msconfig, but maybe I missed it. I didn't have hijackthis on me when I was looking at it tonight so I'll try running that next and see what happens, but since the trojan is running even in safe mode I'm not confident it won't kill that when I try and run it.

Any thoughts or ideas? Thanks!

EDIT: Thanks all for the advice! This one turned out to be one of the trickiest removals I've done. I managed to run HijackThis in Safe Mode, in between popups (it was an obw.exe that kept running) and disabled a bunch of things that didn't look right, but none of them jumped out at me as the offending application. I was also able to run AVG's scan in safe mode but it didn't say it found anything. But somehow I (or the trojan?) managed to disable .exe extensions with running - I booted into regular mode and could no longer launch an application. Every .exe shortcut prompted for which application I wanted to associate it with; trying to run task manager or regedit said it couldn't find the application.

I managed to find some instructions that had me copy regedit.exe to regedit.com, letting me run regedit to try and restore some .exe association so that they would run. I found in the key (ROOT-something?) that it apparently was calling this obw.exe application and running every .exe launch through that. Nice. Anyway, once I restored the registry settings everything seemed to be set. I ran AdAware and MS Security Essentials scans and both came back clean. Crossing my fingers that it'll stay that way!

1
  • Sorry for the non-answer answer... 1) try it anyways, 20 Mar 31, 2011 at 3:29

3 Answers 3

3

To answer your questions...

  1. try it anyways

  2. it's possible that it's a new malware not protected against yet, but more likely somebody clicked on something to install it

  3. again, try it anyways, be sure to run the updates before scanning, and set the scanning options for an aggressive scan

  4. I've removed stuff like this by placing the infected drive in a USB dock and scanning with Symantec Corporate AV. The key is that the infected OS can't be running because the malware is using techniques common to rootkits and kernel hooking.

A good place for tools and info to help you with this is the Microsoft Sysinternals site & forums.

3

It sounds like the user who caught the virus was probably running as administrator - when the FakeAV is running under a limited user, it "installs" itself to the user's appdata folder. Most likely, since it's running in Safe Mode too, even a new user account might not help.

Your friend, in this case, is going to be Malwarebyte's Anti-Malware. Their free download will be able to clean this infection out. If possible, I would recommend pulling the hard drive, popping it into an enclosure, and cleaning it from another computer (that way you're not fighting with running processes, etc). These FakeAVs are great at blocking/deleting Malwarebyte's program exe (your first clue it'll work!).

If you do end up having to run MB's AntiMalware on the infected computer, take a look at their instructions on their forum: I'm infected, what do I do. It covers some of the steps you can take when the infection is actively fighting you from installing their software.

Once it's installed, all you should need to do is run a "Quick Scan" (a full scan if you ended up pulling the hard drive, just pick the hard drive from the list).

Edit:

If you're worried about the program trying to autorun, grab a copy of Microsoft's Sysinternals Suite. The particular program you're looking for is autoruns.exe - check the "Logon" tab and remove anything suspicious-looking. It'll look something like this:

autoruns.exe

2
  • Thanks, MB was what I've been using and was going to try that. I can't install it under safe mode so hopefully it lets me run it on regular login. I wish there was a bootable MB cd or something. My concern is that even scanning the filesystem won't get rid of whatever is loading it in the registry/startup config in the first place. Mar 31, 2011 at 15:44
  • @edmicman - Check out my edit - you'll want to grab Microsoft's Sysinternals Suite - it's got all kinds of tools (process explorer, autoruns, etc) that can help you out. Mar 31, 2011 at 23:04
2

It may be associated to a particular user profile. I saw an infestation of that sort recently, where the user's regular profile was infested such that I had issues with it even in safe mode, but the local admin profile was clean... Or enough so that I was able to carry on with troubleshooting and cleanup, anyway. Naturally, I made sure to pick through her profile once I realized the nature of the situation.

So, try logging in with a different profile. It might help.

1
  • Thanks! I think this is Vista Home (Premium maybe?), I'm not sure what the admin login is right now but I'll check that out. Mar 31, 2011 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .