Yikes, nasty virus here. Assistance required.

[Dekker]

Everything was going fine 30 minutes ago so I go to take a shower and when I come out I have this thing on my screen saying I have viruses and should install their program(yea...I'll believe that when pigs fly) Start up my usual protection program but this fake "antivirus software" keeps denying access to them and won't let the scanners start up. So I try a web based scan that I usually use but of course I have to use IE and this "virus software" has killed that as well(won't load up anything). Firefox still functions but IE has definitely been spiked. I haven't downloaded or opened anything mysterious, and I run scans every 3 days......I'm technologically inclined and I feel like such a turd for being compromised.

No programs can be installed or run in regular mode....I have never had a virus this gnarly before....

[nick]

The trick is to remove this malware's resident processes from memory before running the scanner (which you can do with Task Manager). If you're familiar with Task Manager or similar programs, you know what to do, if not, now's not the time to learn. Try to determine which malware you have, and then search for removal instructions online. You may also identify the files it uses, and boot from a CD (or into recovery console), delete those files, and then run the scanner. IN either case, make sure you're physically disconnected from the INternet (or the malware might just download the files again).

Another solution is to pull out your hard drive and scan it on some other machine (while it's plugged in as a secondary hard drive).

Also, keep in mind that US-based antimalware packages may not legally remove some of such crap (thank you, o smart judge). Malwarebytes (www.malwarebytes.org) is likely to work.

[SmokinMr2]

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

[wombat303]

Sorry Decker, my dad just got hit with something similar.

Start Windows, press F8 a few times after your Power on Self Test (POST) that usually states the manufacturers name, and boot into safe Mode. You don't want the network or console versions.

Download your tools on a friends machine, and then bring them over via flash drive. Get malwarebytes anytimaleware (MBAM) and Nick suggested which will kill most killable things. Failing that, you can try Super Anti-Spyware (SAS) but I prefer MBAM. If you can't run task manager in your regular windows session, you have a version that ran across only once and you are pretty much hosed, but try these options regardless.

I boot back and forth between OS10.6 and Win 7, the first to surf and research, the other to do real work. Stay away from Facebook or at least away from the games.

[NSR500]

Shutdown your machine and run a bootable edition of malwarebytes, and kapersky. It'll clean your machine without the OS running.

[freonr22]

microsoft security essentials if windows, mbam, ccleaner, spybot search and destroy. as a package...

[Curtis]

I picked up the same thing; once at home and once at work. My wife got it first a couple of month ago. After opening up IE or FoxFire once they didn't work. I used Kapersky boot up to fix the problem. The office situation was last week. This time the program wouldn't allow me to open Task Manager. I opened up in safe mode and then shut down. My system then prompted me to recover a previous saved version that solved the issue.

[high_revs]

microsoft security essentials if windows, mbam, ccleaner, spybot search and destroy. as a package...

when i got hit wiht a trojan, i installed spybot, ms essentials then malwarebytes. only malware got the trojen. i think ms essentials is a joke now.

i think someone else said it before. when they get hit with the virus, wipe and start over. i did, though not all from scratch since i keep system images at each phase (os only, os + patches, os + patches + some apps, etc.).

[Lyte-]

Microsoft also has a free software you can downlaod called Malicious program removal tool or something like that.

You should download all these programs from another computer and save them to a USB drive and boot into safe mode with no networking as someone suggested.

Always run more then one program as no one program can get everything.

[jchen76@gmail.com]

Sounds like the dreaded malware 2009 virus. It downloads windows messages to say your PC infected and buy some software to alleve it? Whatever you don't, do buy there software.

If this is the virus - use the following manual instructions http://www.2-spyware.com/remove-antivirus-2009.html

The virus was nasty for me, I could not install antivirus/malware. It had ability to block the virus's ability to block the anti virus executable names.

[sevensix2x51]

format c: /s

thats what i do, anyways...

[nick]

format c: /s

thats what i do, anyways...

Got lots of free time?

Besides, you'd still have to boot into some sort of DOS environment to do that (otherwise the access to the boot and system drives would be locked by Windows), and why on earth would you try to make it a DOS system disk?

[ojisan]

I had this yesterday.
It would not allow me access to Task Manager.
I burned a disc copy of the free Super Anti-Spyware on my son's PC.
Load the Super in regular mode.
The virus will fight you and say that the download failed.
Shut down, Restart in safe mode (keep hitting F8), check your programs, you will see that the Super file did actually download.
Run the Super.
(And whatever others as suggested here using the same steps).

[Hoop]

Sorry Decker, my dad just got hit with something similar.

Start Windows, press F8 a few times after your Power on Self Test (POST) that usually states the manufacturers name, and boot into safe Mode. You don't want the network or console versions.

Download your tools on a friends machine, and then bring them over via flash drive. Get malwarebytes anytimaleware (MBAM) and Nick suggested which will kill most killable things. Failing that, you can try Super Anti-Spyware (SAS) but I prefer MBAM. If you can't run task manager in your regular windows session, you have a version that ran across only once and you are pretty much hosed, but try these options regardless.

I boot back and forth between OS10.6 and Win 7, the first to surf and research, the other to do real work. Stay away from Facebook or at least away from the games.

I had that same crap, booted into safe mode, ran AVG and it got rid of it. Also if you search the net for whatever it's called (I have a hunch it's something like TOTAL SECURITY 2000 etc) there will be directions for how to delete the infected files manually.

[Dekker]

Thanks, I managed to get rid of the main culprit but I believe there is something left. The virus or w/e would not let me open up any programs or my Task Manager, but like any other program on my computer it didn't instantly pop up but rather took about 1 minute after I logged in before it activated itself. So as soon as I finished logging in, I smashed Ctrl Alt Del and managed to get it open before the program started locking everything down. Found a mysterious fsrmysguard.exe file in the processes and decided to end it....low nad behold the lock down ended and I was free to start up all my programs. Booted up into Safe Mode, unplugged ethernet and ran EVERYTHING I had and of course what shows up in the scan......fsrmysguard.exe.

Deleted it and the other 2 Trojans on my comp but somehow it is still locking down my internet. I'm using Firefox and as you can see the internet works, but if I start up Internet Explorer it will always fail. And any of my programs like AIM, Steam or anything else that requires an internet connection.......keeps giving me errors. There's either still a virus left that the scanners aren't catching or it messed up how my computer connects to the net.