Crazy Virus.

**Gingersnap** · 12-28-2010, 02:03 PM

I got infected with a fake alert virus (from a knitting pattern site of all things) and also a Google redirect virus.

The virus prevented me from using Malwarebytes until I figured out a workaround. I ran Rkill and Malwarebytes as well as my usual firewall stuff. Now things seem normal but I'm hesitant to reboot since when I did before (midway through the scouring process), the fake alert returned.

Is there anything else I should run before rebooting? I use this notebook every day so theoretically, I could just let it sleep and never reboot until replacing the battery. ;)

**Rockntractor** · 12-28-2010, 02:15 PM

Originally Posted by Gingersnap

I got infected with a fake alert virus (from a knitting pattern site of all things) and also a Google redirect virus.

The virus prevented me from using Malwarebytes until I figured out a workaround. I ran Rkill and Malwarebytes as well as my usual firewall stuff. Now things seem normal but I'm hesitant to reboot since when I did before (midway through the scouring process), the fake alert returned.

Is there anything else I should run before rebooting? I use this notebook every day so theoretically, I could just let it sleep and never reboot until replacing the battery. ;)

If it was me I would reformat the drive and reload Windows.

**megimoo** · 12-28-2010, 02:26 PM

Originally Posted by Gingersnap

I got infected with a fake alert virus (from a knitting pattern site of all things) and also a Google redirect virus.

The virus prevented me from using Malwarebytes until I figured out a workaround. I ran Rkill and Malwarebytes as well as my usual firewall stuff. Now things seem normal but I'm hesitant to reboot since when I did before (midway through the scouring process), the fake alert returned.

Is there anything else I should run before rebooting? I use this notebook every day so theoretically, I could just let it sleep and never reboot until replacing the battery. ;)

I had the same problem with that virus.My daughter uses AVAST PRO and after a couple of running it days the virus was locked in the Virus vault .
VIRUS NAME
WIN 32:FakeAV-ANH
JS:FakeWarn-E

there were five of them scattered in various directories but they are gone now.I hate to pay for software but that thing had me all locked up.

The symptoms that you describe are much the same,as long as you are in an executable no problem but going back to the exec the virus locks you out.

The virus was smart enough to corrupt my system restore files disabling my ability to restart at an earlier uncorrupted date.

http://www.avast.com/pro-antivirus

**megimoo** · 12-28-2010, 02:40 PM

Originally Posted by Rockntractor

If it was me I would reformat the drive and reload Windows.

I tried that but the Virus was in SyS$Root .I swapped drives to an older smaller XP backup and the virus jumped to that drive.After I installed AVAST I was able to delouse both drives !

**Gingersnap** · 12-28-2010, 02:42 PM

Originally Posted by megimoo

.

The virus was smart enough to corrupt my system restore files disabling my ability to restart at an earlier uncorrupted date.

This is something I'm kind of worried about. :(

**hampshirebrit** · 12-28-2010, 02:48 PM

Originally Posted by Rockntractor

If it was me I would reformat the drive and reload Windows.

If it was me, I'd get a mac.

But then, it is me, so I don't need to.

**Rockntractor** · 12-28-2010, 02:51 PM

Originally Posted by megimoo

I tried that but the Virus was in SyS$Root .I swapped drives to an older smaller XP backup and the virus jumped to that drive.After I installed AVAST I was able to delouse both drives !

Avast is what I use.

**megimoo** · 12-28-2010, 03:04 PM

Originally Posted by Gingersnap

This is something I'm kind of worried about. :(

It didn't disturb any of my data but tried to get me to load their so called anti virus crap.With my new anti virus suite running it blasts a warning when ever I visit a virus honey pot site by accident .

This Trojan uses psychological warfare and accuses me of visiting 'X' rated sites displaying pages from hard core sites to drive me to load their software with a larger virus load.

But I am innocent of those charges...honest !

After running it for a few days I changed the scan parameters and did a deep system scan on both drives that ran for several days.That picked up two more 'sleeper' viruses and locked them up in the vault !I'm sure there are a few more lurking somewhere on the drives but time will tell !