LandzDown Forum

Security => Analysis and Malware Removal => Topic started by: Adam444 on June 28, 2011, 09:07:21 AM

Title: Mom's Computer Infected
Post by: Adam444 on June 28, 2011, 09:07:21 AM
My mom's computer has been infected with "XP Anti-Spyware 2012."  Unfortunately she's 900 miles away and not very computer literate.  I had her reboot into safe mode to see if the infection would run there but it did.  I do have a sister that I could email files to and have her run them but things like logs might be difficult to obtain (dear Sis is only somewhat more savvy than Mom).

Can anyone help?

Thanks!
Title: Re: Mom's Computer Infected
Post by: Corrine on June 28, 2011, 02:37:03 PM
Hi, Adam444.

Your Mom raised you and your sister.  I suspect that she is much more competent that you realize.  :) 

Seriously, I will provide instructions for removing the rogue but without having logs to examine, we will not be able to determine if the computer is indeed clean or what steps may be needed in order to protect the computer from further infection.  Keep in mind also that there are instances of this infection where it is not possible to download the needed files and it is necessary to transport the files to the infected computer. 

With that, following are the instructions to get started:

1)  Please download the following two files to the desktop.  In the event you are blocked by the malware from downloading, it will be necessary to go to an uninfected computer and then transfer the files to the infected computer via CD/DVD, external drive, or USB flash drive. 

It may also be possible to download the files in Select Safe Mode with Networking. (To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard. Using the arrow keys on your keyboard, select Safe Mode with Networking and press Enter on your keyboard. Windows will now boot into safe mode with networking and prompt you to login as a user.) 

FixNCR.reg (http://download.bleepingcomputer.com/reg/FixNCR.reg)
Bleeping Computer Downloads: RKill (http://www.bleepingcomputer.com/download/anti-virus/rkill)

2)  If downloaded to the desktop, double-click the FixNCR.reg file.  If transported to the infected computer, insert the removable device into the infected computer and open the folder the drive letter associated with it. Double-click the FixNCR.reg file to fix the Registry on your infected computer.

3)  Again, if downloaded to the desktop, proceed as shown below.  Otherwise, copy the downloaded RKill file to the desktop of the infected computer and proceed:
Notes: If you you receive security warnings about rkill, please ignore and allow the download to continue.

4)  Please download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam.php) to your desktop.

** Note **

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

In addition to the MBAM log, please return to the "Log Posting Instructions (http://www.landzdown.com/index.php/topic,423.0.html)" topic and provide the requested logs from that topic, noting that it may take more than one reply.  This is necessary as explained above in order to determine what other steps are needed.

Thank you.
Title: Re: Mom's Computer Infected
Post by: Adam444 on June 30, 2011, 11:20:22 AM
Corrine,

Just out of curiosity and to better understand what's going on, why exclude the System Volume Information files?  Are they restore points that Malwarebytes picks up in error?

Thanks!
Title: Re: Mom's Computer Infected
Post by: Corrine on June 30, 2011, 02:07:58 PM
Hi, Adam444.

The reason I recommend excluding System Restore is that while attempting to clean an infected restore point, more often than not, the program ends up damaging that restore point, making it useless.  Should something go wrong in the cleanup process, having an infected restore point to restore is better than none, even though it means starting the cleanup process over again. 

After the computer is clean is the time to create a new restore point and remove all the other restore points with the disk cleanup tool.
Title: Re: Mom's Computer Infected
Post by: Adam444 on June 30, 2011, 03:02:06 PM
Corrine,

That certainly makes some sense.  Frankly if the disinfection doesn't work, the next step is to simply wipe the drive and start over.  Mom really has very little on her computer (she uses it mostly for email and games) so she wouldn't loose much if anything.

Thanks again for you help!

Adam
Title: Re: Mom's Computer Infected
Post by: Corrine on June 30, 2011, 04:17:44 PM
You're welcome, Adam. 

If you cannot get logs for me to review, at least check that your Mom's computer has old, vulnerable versions of Java removed and updated to the latest version.  The same goes for Adobe Reader and Adobe Flash.  To check if her system is missing security updates or has insecure applications, install Secunia Personal Software Inspector (http://secunia.com/vulnerability_scanning/personal/) or, alternatively, visit http://secunia.com/software_inspector/ .  The Secunia Software Inspector runs through your browser with no installation or download required and does the following: