Windows XP 2010 says PC infected

[Myles45]

Hi all, need some advice please.
I have Avast 4.8 Pro. It detected win32fakeAlert-IH[Drp] today in email attachment
& I sent it to virus chest.
I now have Windows telling me 25 infections found, system integrity threat! Stealth intrusion & various other things constantly. & that I need to activate my copy now!! & also that my firewall is off.

Should I activate antivirus XP 2010? As I understand it's not right to run more than one antivirus software at once.  & should I activate the firewall?

How can I tell if the 25 "serious issues" it detected are actually on my system or not? & why has Avast not detected them?

Thanks in advance
regards
myles

[harman123]

Hi Myles45

antivirus XP 2010 is a ROGUE.

Download Malwarebytes from http://www.malwarebytes.org/ and updated run quick scan. whatever it founds remove it. After you used malwarebytes, use superantispyware from http://www.superantispyware.com/ also updated and run full scan.

[Myles45]

Thanks Harman,
I just read a previous thread about UPS email. And that's actually what happened to me( stupidly opened attachment innocently, as we'd had deliveries from them over Xmas )
is there anything else I should do with this in mind?

Also, just went to windows security centre in control panel, to check firewall status & it says in there that "antivirus XP 2010 reports firewall turned off" is it possible that this ROGUE has got in there? & if so is windows security centre compromised also?

I have currently disconnected my PC from Internet. Obviously I need to reconnect to download the antimalware software. Is there anything i should be doing to protect the PC whilst I'm back online. I.e with regards to firewall etc?

Thanks

[harman123]

Well usually rogue display fake alert messages and hijacked your security center in order for unsuspected person to purchased. from what I understand you can download both superantispyware and malwarebytes.

xp antivirus 2010 removal guide

http://forums.techarena.in/networking-security/1111989.htm

[Pondus]

Is there anything i should be doing to protect the PC whilst I'm back online. I.e with regards to firewall etc?

Malwarebytes Antimalware PRO will stop it, a one time fee for a lifetime license  www.malwarebytes.org

Automated Removal Instructions for XP Internet Security 2010, Antivirus Vista 2010, and Win 7 Antispyware 2010 using Malwarebytes' Anti-Malware: http://www.bleepingcomputer.com/virus-removal/remove-antivirus-vista-2010

[Myles45]

Thanks for replies & links. Have downloaded both softwares & superantispyware is scanning as we speak. I could not run malwarebytes for some reason, I presume the virus it stopping it.
When I do get everything sorted, is it ok to run both of the above alongside avast?

Also is it safe to have any other programs open on my computer whilst doing these scans?

I have sign writing business & could do to be doing a bit of work!!

[Pondus]

When I do get everything sorted, is it ok to run both of the above alongside avast?

Yes, see my signatur

I could not run malwarebytes for some reason, I presume the virus it stopping it.

the first 5 steps in the guide i sendt is about how to fix that.
If that does not work you can try the manuall removal guide harman123 sendt

Also is it safe to have any other programs open on my computer whilst doing these scans?

Not sure, but i would not do it

[harman123]

If you have trouble installing or running MalwareBytes If you got them downloaded rename the setup file then try installing them again.

Right click the mbam-setup.exe file> click rename> rename it something.exe then try to run it. If it installed but will not run navigate to this folder:

C:\Programs Files\Malwarebytes' AntiMalware

Rename the mbam.exe file then try to run it again, if still no luck rename all the .exe files in the MAlwarebytes' Anti-Malware folder and try to run it again.

[scythe944]

If you have trouble installing or running MalwareBytes If you got them downloaded rename the setup file then try installing them again.

Right click the mbam-setup.exe file> click rename> rename it something.exe then try to run it. If it installed but will not run navigate to this folder:

C:\Programs Files\Malwarebytes' AntiMalware

Rename the mbam.exe file then try to run it again, if still no luck rename all the .exe files in the MAlwarebytes' Anti-Malware folder and try to run it again.

Or download this: http://download.bleepingcomputer.com/grinler/rkill.com first and run it.  This will shut the Rogue down and allow you to install and run MBAM (usually).

If you're running SAS though, that should do it.  Just wait until it removes the rogue, and reboot, then MBAM should be able to install afterwards.

[Myles45]

Or download this: http://download.bleepingcomputer.com/grinler/rkill.com first and run it.  This will shut the Rogue down and allow you to install and run MBAM (usually).

If you're running SAS though, that should do it.  Just wait until it removes the rogue, and reboot, then MBAM should be able to install afterwards.
[/quote]

Thanks for that, just did it & it seems to have stopped the Rogue, but when I try to run MBAM a box opens asking me what program I want to use to open the exe. file what do I use to open it?

[harman123]

Looks like your malwarebytes download is corrupt. Try to download fresh copy again.

[scythe944]

Yeah, it's an .exe.  You don't need anything to open it, it should open by itself.

Wait, harman123 told you to try renaming the .exe before in this thread.  If you did, make sure the file extension is correct (.exe).  It's probably better to just download MBAM again anyway though, just to be safe.

[Myles45]

OK,
Now I think I have a problem!! :'(

Avast found several more viruses after SAS scan & advised shut down & boot scan which I did & now that computer has restarted... No exe files will open when I click them & none have opened in the system tray including avast & SAS  What do I do now please

[Myles45]

This is what avast found in boot scan:

11/06/2008 21:50
Scan of all local drives

Number of searched folders: 7031
Number of tested files: 102098
Number of infected files: 0

----------------------------------------
03/03/2010 20:34
Scan of all local drives

File C:\Documents and Settings\Administrator\Local Settings\Application Data\trz17B.tmp is infected by Win32:Malware-gen, Moved to chest
File C:\System Volume Information\_restore{8D290BB5-E59C-462B-A0EE-E8949A1E4344}\RP818\A0142120.exe is infected by Win32:Malware-gen, Moved to chest
Number of searched folders: 12766
Number of tested files: 196252
Number of infected files: 2

[harman123]

First disable your system restore and after you clean up your system, then re enable it.