Urgent Help w/ Virus Issues

[DrFuNk328]

My roommate is being dominated by the "Antivirus 360" fake security patch. He mistakenly bought into this worm. We are looking for any additional help to over-ride and cease this virus from corrupting his computer further.

He doesn't know what else to do and thus I have tried to help him out. I have tried searching for it manually and deleting the "SOB" but I am very unsuccessful. I have also tried restoring his system to a prior point, but it seems the worm is doing its job. I apologize for such a noob topic, but any help would be greatly appreciated. THANKS!

ps...he is running XP.

 

[mechBgon]

As an opening move, back up his important stuff, and then try scanning the system with these two bootable CDs:

http://www.f-secure.com/linux-...escue-cd-300-released/ (download the Zip file, and burn the .ISO to CD using imgburn or whatever)

http://www.free-av.de/en/tools...vir_rescue_system.html (this .exe makes a bootable CD directly)


Once they've been run, now boot into Windows, install Superantispyware, have it update, and then let it scan (bonus points for rebooting into Safe Mode after updating, and scanning in Safe Mode).

After that, run HijackThis and post a logfile to see where it's at. Also run the free Secunia vulnerability checkup utility to fix stuff that might've been used to install the scamware.

BTW later on I'm going to scoot this over to the Security forum, so if you don't see it here, it's over in Security :beer:

 

[DrFuNk328]

MechBgon,

Hey, I appreciate the help.

First of all, I will forward this information to him and see what he says. He says he is going to take his laptop to a tech place for help. He isn't that tech savy and I was just going to provide him some information on this issue.

Second of all, I agree with these steps, I bet these will work, but I'm sure he won't do it. To much hassle I guess. I guess you could say college kids these day...to lazy. haha

Last, I apologize that I didn't put this on the Security forum. I just needed a quick response thats all. I'm sorry, and I am ok with this being switched over.

Thanks again!!

 

[roc17]

See my earlier post in this forum - Roc17. A responder suggested 'malwarebytes' which cleaned it up just fine.

Good luck.