new twist on win7antivirus2011

BleepingComputer.com: new twist on win7antivirus2011

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

If you have not received help after three days, please post a link to your topic HERE.

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

new twist on win7antivirus2011 fake antivirus using ie

#1 douglas350

Member

Group: Members
Posts: 27
Joined: 01-January 08

Posted 09 April 2011 - 08:53 AM

I am running windows 7 on a dell laptop. Yesterday I started receiving virus alerts claiming to be from win7 antivirus 2011 which is a version of a malware program described on other parts of this site.

Unfortunately whenever I try to run any program now including the various versions of rkill and avast a screen opens offering me the option of using either windows internet explorer or windows media to open and run them. The same applies if I try to use the internet except I find if I click on internet explorer then on one of the recently visited sites there iit does work and I can then access the web pages. I have tried system restore and that also offers th option of opening it using internet explorer or media player.

All of the excellent help described on this site for removing this fake antivirus does nto seem to work for me because the very programs I need to run will not run in internet explorer or windows media. I can get a list of some other programs up as well but nothing that will run rkill or malwarebytes.

I do have another computer available and a memory stick.

This post has been edited by hamluis: 09 April 2011 - 09:11 AM
Reason for edit: Moved from Win 7 to Am I Infected.

#2 douglas350

Member

Group: Members
Posts: 27
Joined: 01-January 08

Posted 09 April 2011 - 06:54 PM

Well my posting yesterday is an example of not reading all the other problems and posts discussed on here before posting.
I have solved it with hints from other postings on other similar problems. Since this may save someone else some time I have just listed what I did to fix it. Very grateful thanks to the other contributors on similar problems which helped me.

Basically I was infected by a bogus antivirus program called Win.7 antivirus 2011. What ever program I tried to run responded by trying to open in internet explorer or windows media player. None to the different files for rkill would work to stop the activities and let me run malwarebytes.

Using another computer I downloaded fixNCR from netC I loaded this into the affected laptop and it removed two registry infections. This allowed rkill to run followed up by malwarebytes and then everything was fine.

Thanks guys.