virus has got me good this time!

[Old Man [OFPR]]

A few months back I had a virus running on my comp,
but i followed the simple guide on the first sticky about malware removel and it worked great.

Today my kid says "hey dad, not sure what happened but something is not right with the computer" next thing i know there is a program called total security trying to run a virus scan and i knwo i never installed anything called total security.

anyway, last time something like this happend, I followed the guide and the programs as described in the sticky. Problem is this time I am unable to access any programs, i tried to right click "my comp" so i could go into properties and disable restore so i can restart in safe mode, i won't allow me open properties.

how else can i open up my comp in safe mode? i really do not want to restore to factory settings, i would lose a lot of pictures and songs, and i would have to reinstall a whole lot of load of programs.

sooo, any suggestions? can i restart in safe mode a differnt way? should i use kerosene and just torch it?

 

[Stinky Wizzleteats]

when you start the computer tap the f8 key (before windows loading screen) & youll get a adv start menu with safe mode being one of your choices. If the computer isnt recognizing the key taps then your mobo's bios setting is probably set to "OS" for usb control (assuming youre on a usb keyboard) & itll be in your on chip settings. TO get into your bios settings, look at the bottom of your screen and look for the "Press (key) to enter setup" or something along those lines & hit that key.

Hope that helps

 

[gothroach]

Restart wait for it to finish its POST, then spam F8. If you hit F8 between the time the BIOS is done with its tests/enumeration/detection and when the Windows loading screen comes up, a boot options menu will show up. From there, you have several options, but safe mode is the one you'll likely want to use. If you need an internet connection for scanning or updating virus protection, then select safe mode with networking.

Let me know how that goes, and we can continue from there .

 

[gothroach]

when you start the computer tap the f8 key (before windows loading screen) & youll get a adv start menu with safe mode being one of your choices. If the computer isnt recognizing the key taps then your mobo's bios setting is probably set to "OS" for usb control (assuming youre on a usb keyboard) & itll be in your on chip settings. TO get into your bios settings, look at the bottom of your screen and look for the "Press (key) to enter setup" or something along those lines & hit that key.

Hope that helps

Haha, beat me to it .

 

[Prisoner416]

Tools to delete this and more info helping from
http://www.2-spyware.com/remove-total-security.html


Total Security manual removal:
Kill processes:
tsc.exe Sc2C21UvvM.exe [RANDOM NUMBER].exe

Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"[RANDOM NUMBER]" = "%UserProfile%\Application Data\[RANDOM NUMBER]\[RANDOM NUMBER].exe"
HKEY_LOCAL_MACHINE\SOFTWARE\[RANDOM NUMBER]\"pc[RANDOM NUMBER]ins" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\[RANDOM NUMBER]
HKEY_CURRENT_USER\Software\1FD92E3F7C34799BFB075C41DA05D1FE
HKEY_CLASSES_ROOT\CLSID\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "1FD92E3F7C34799BFB075C41DA05D1FE"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"


Unregister DLLs:
winsource.dll

Delete files:
tsc.exe Sc2C21UvvM.exe winsource.dll TSC.lnk Help.lnk Registration.lnk Uninstall TSC.lnk [RANDOM NUMBER].exe

Delete directories:
c:\Program Files\TSC
%UserProfile%\Start Menu\TSC
c:\Program Files\Common Files\System\Uninstall
%UserProfile%\Application Data\[RANDOM NUMBER]
%UserProfile%\Application Data\[RANDOM NUMBER]\pc[RANDOM NUMBER]ins


Total Security is a rogue anti-spyware application that displays false scan results to convince you that your computer is infected with malware. The rogue program is a clone of another fake spyware remover called System Security. Usually, Total Security is installed through the use of Trojan viruses that display fake security alerts about various infections and security problems. Eventually, TotalSecurity access the system without user's knowledge and permission. On the other hand, the rogue can be also downloaded and installed manually, but this is less common situation.

Once installed, Total Security performs fake system scan and displays various infections that cannot be removed until you first purchases the program, because trial version is supposedly unable to remove those infections. Actually, these infections do not really exist and are being shown only to scare you hopping that you will buy a license of Total Security 2009. The rogue may also display the Total Security Protection Center window which is very similar to legitimate Windows Security Center notifications. What is more, Total Security terminates popular anti-malware applications when users try to perform system scan. To make things worse, TotalSecurity will constantly display fake security warnings.

 

[Old Man [OFPR]]

I did try that, safe mode is not one of the options, my guess is, it is because I am unable to turn off the the recovery mode

The 3 options that appear she I spam the F8 key are

Sm-pioneer DVD-RW
1st Floppy drive
Pm-st3160021a

Those are the choices, sounds like it is asking me which drive I want to insert the recovery disk in.

 

[Old Man [OFPR]]

Tools to delete this and more info helping from
http://www.2-spyware.com/remove-total-security.html


Total Security manual removal:
Kill processes:
tsc.exe Sc2C21UvvM.exe [RANDOM NUMBER].exe

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun"[RANDOM NUMBER]" = "%UserProfile%Application Data[RANDOM NUMBER][RANDOM NUMBER].exe"
HKEY_LOCAL_MACHINESOFTWARE[RANDOM NUMBER]"pc[RANDOM NUMBER]ins" = "1"
HKEY_LOCAL_MACHINESOFTWARE[RANDOM NUMBER]
HKEY_CURRENT_USERSoftware1FD92E3F7C34799BFB075C41DA05D1FE
HKEY_CLASSES_ROOTCLSID{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "1FD92E3F7C34799BFB075C41DA05D1FE"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center "FirewallOverride" = "1"


Unregister DLLs:
winsource.dll

Delete files:
tsc.exe Sc2C21UvvM.exe winsource.dll TSC.lnk Help.lnk Registration.lnk Uninstall TSC.lnk [RANDOM NUMBER].exe

Delete directories:
crogram FilesTSC
%UserProfile%Start MenuTSC
crogram FilesCommon FilesSystemUninstall
%UserProfile%Application Data[RANDOM NUMBER]
%UserProfile%Application Data[RANDOM NUMBER]pc[RANDOM NUMBER]ins


Total Security is a rogue anti-spyware application that displays false scan results to convince you that your computer is infected with malware. The rogue program is a clone of another fake spyware remover called System Security. Usually, Total Security is installed through the use of Trojan viruses that display fake security alerts about various infections and security problems. Eventually, TotalSecurity access the system without user's knowledge and permission. On the other hand, the rogue can be also downloaded and installed manually, but this is less common situation.

Once installed, Total Security performs fake system scan and displays various infections that cannot be removed until you first purchases the program, because trial version is supposedly unable to remove those infections. Actually, these infections do not really exist and are being shown only to scare you hopping that you will buy a license of Total Security 2009. The rogue may also display the Total Security Protection Center window which is very similar to legitimate Windows Security Center notifications. What is more, Total Security terminates popular anti-malware applications when users try to perform system scan. To make things worse, TotalSecurity will constantly display fake security warnings.

That is what it is doing, but I am unable to open up the legit anti spy ware.

I just purchased the latest Kaspersky Internet 2010, didn't get a chance to install it and now I am unable to install it

 

[gothroach]

I did try that, safe mode is not one of the options, my guess is, it is because I am unable to turn off the the recovery mode

The 3 options that appear she I spam the F8 key are

Sm-pioneer DVD-RW
1st Floppy drive
Pm-st3160021a

Those are the choices, sounds like it is asking me which drive I want to insert the recovery disk in.

Wait a little bit longer before hitting the key - some motherboards use F8 as the boot options menu also.

 

[batterytime]

If all else fails, and you can't remove the virus, don't torch your comp. Just wipe and restore, using whatever recovery system your computer comes with. This will unfortunately clear out all the files on your computer, so copy all important data over in safe mode or whatever mode you can get into before you wipe and clear.

Something less drastic to try is System Restore, go into Control Panel and you should be able to find it. Knowing SR, you have a 10% chance of working, but it's worth a shot.

 

[gothroach]

If all else fails, and you can't remove the virus, don't torch your comp. Just wipe and restore, using whatever recovery system your computer comes with. This will unfortunately clear out all the files on your computer, so copy all important data over in safe mode or whatever mode you can get into before you wipe and clear.

Something less drastic to try is System Restore, go into Control Panel and you should be able to find it. Knowing SR, you have a 10% chance of working, but it's worth a shot.

In my experience, most malicious software will remain after doing a system restore.

 

[RustyPwns!]

2 very simple solutions.

1) Reinstall windows

OR

2) http://www.superantispyware.com/ just run it and it'll annihilate any type of malware.

Personally I enjoy a cute malware strike. It's funny how it hi-jacks your homepage and tells you to buy some wack anti-virus. Enjoy it while it lasts!

 

[s14sh3r]

Save your pictures, files and music to a thumb drive or disc.
Reinstall windows, doing a full format.
Install all updates.
Install virus protection of your choice.
Scan your files before you put them back on the computer.

It's the only way to be 100% sure you get all the malware.

You can either take my advice, or spend twice as much time trying to get it cleaned, with a good chance of something remaining.

 

[Prisoner416]

Try running combofix.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Try running SDFix.

http://www.bleepingcomputer.com/forums/topic131299.html

Run TFC.

http://www.geekstogo.com/forum/TFC-Temp-File-Cleaner-OldTimer-file187.html

 

[Old Man [OFPR]]

well, i did get it to open up in safe mode and am running malwarebytes now,

my guess is that all will be ok now, thanks for all your advice guys

 

[iOprah]

2 very simple solutions.

1) Reinstall windows

OR

2) http://www.superantispyware.com/ just run it and it'll annihilate any type of malware.

Personally I enjoy a cute malware strike. It's funny how it hi-jacks your homepage and tells you to buy some wack anti-virus. Enjoy it while it lasts!

I would not say reinstalling windows is very simple.

 

[Prisoner416]

I would not say reinstalling windows is not very simple.

I wouldn't say that's not a double negative.

 

[Rabid Ewoks]

For the utmost security I recommend on scanning your computer from a safe operating system to make sure there are no root-kits messing with your AV scan.


Rootkits can completely hide files from anti-virus, so the only way to remove them is to boot into a safe os like a live-cd.


I recommend you download Trinity Rescue Kit

Features

TRK is based on Linux 2.6.26.

* 6 consoles (accessed using alt+F1, etc.)

* The ability to update itself (antivirus definitions/drivers) if burned onto a CD-RW

* Data Recovery Tools

* Clone Windows over a network

* Antivirus Scanner
o ClamAV
o F-Prot
o AVG Anti-Virus
o BitDefender
o Avast

* Reset Windows passwords

* Read/Write to NTFS partitions through ntfs-3g
o clonentfs allows copying of all used space on a drive
o Better support for Vista in build 321

* Edit partition layout

* SSH Server

* Samba server
o Share all local drives on network as a user or a guest

* Logical Volume Management

* Proxy server support

* Bridging Capabilities
o Allows tcpdump when traffic passes other computers

 

[XXzz-Trauma-zzXX]

I wouldn't say that's not a double negative.

I wouldn't not agree with Prisoner saying that isn't not a double negative. o.0

 

[Old Man [OFPR]]

well about 4-5 hours later, we are back in business!
i am having trouble uninstalling Norton, just doesn't want to leave the party even though everyone hates him!!!

but i did get Kaspersky Internet Security 2010 installed

thanks again guys

 

[Toasteddude]

Now would be a good time to consider periodically backing up your important files on some sort of external media. That way, you can safely reformat in case the virus is over your head.