Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus Protector Infection


  • Please log in to reply
8 replies to this topic

#1 matthewdf

matthewdf

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:10:07 PM

Posted 02 March 2010 - 10:13 PM

Ok, here is the situation. I am helping someone clean their computer of a bunch of infections. The first thing that I have noticed is that they have the rogue AV called Virus Protector. I have done quite a bit of searching and have found basically all of the same instructions on how to remove it, except all seem to be missing a critical part. I have booted into Safe Mode with networking, but Virus Protector STILL pops up and doesn't give me the chance to close it so I can run Malwarebytes. The only thing that I have the ability to do in Safe Mode, is to boot into Safe Mode with command prompt. I have looked at all of the startup locations for any files named suspiciously like 123456.exe and can't find anything. I am not able to get to the task manager as it isn't available when I press ctrl+alt+delete. BTW, this is a Vista computer that I am working on. Can anyone give me some advice on how to stop this pesky thing from popping up so I can run real antivirus apps.

Thank you in advance,

Matt

BC AdBot (Login to Remove)

 


#2 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:10:07 PM

Posted 04 March 2010 - 09:47 PM

Hello :thumbsup:

There are steps listed in this guide that you did not mention, so I am not certain you've tried this:
How to remove VirusProtect or Virus Protect (Removal Instructions)
by Grinler

http://www.bleepingcomputer.com/forums/t/98219/how-to-remove-virusprotect-or-virus-protect-removal-instructions/
If we don't change the direction we are going,
We are likely to end up where we are headed.

#3 matthewdf

matthewdf
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:10:07 PM

Posted 06 March 2010 - 08:09 AM

Those are all great suggestions, but I feel like people aren't reading my posts. Everything that is mentioned in there requires me to be able to get to the desktop. I can't ever get to the desktop, regardless of how I boot the computer (regularly, safe mode, safe mode w/networking). The Virus Protector takes up the entire screen, like it is an autorun program. I don't have a start button or task bar or anything. None of the windows hot keys work to get to minimize the program either. The only thing that I can do with the computer is to get into safe mode with command prompt, or boot it with a UBC4WIN disc.

#4 RHendricks

RHendricks

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:07 PM

Posted 07 March 2010 - 10:27 AM

I'm in the same boat. Got infected with Virus Protector and can't get to desktop or Explorer even in safe mode. Any suggestions?

Thanks

#5 horsewithnonick

horsewithnonick

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:07 PM

Posted 07 March 2010 - 08:36 PM

The latest variant of Virus Protector is doing some new things - it replaces Explorer.exe as the Windows shell as well as disabling Registry editing and access to Task Manager.

I got lucky earlier today working on an infected machine, when the Windows Security Center popped up to warn me that the firewall was not being monitored - I followed a link to Help and Support, and from there to the Microsoft support page, then downloaded and ran Hijack This to remove the offending entries.

I had not tried to reach a command prompt, but if you have that you should be able to type 'iexplore.exe' to reach the internet and download the software.

Hope this helps,
Greg

P.S. Virus Protector will, of course, continue to spam you with its dire warnings, all of which are utter BS, but which will pop up in front of whatever you are doing - so ALT-TAB wil be your best friend...

Edited by horsewithnonick, 07 March 2010 - 09:40 PM.


#6 slumslum

slumslum

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:07 PM

Posted 08 March 2010 - 12:20 PM

I came here earlier today looking for a solution for this. After about 2 hours working on this problem, I was able to remove the Malware myself. I was also disappointed that some people didn't bother to read the original post and just posted guides that were not relevant to this variation. Way to up your post count.

1. First Download Malwarebytes onto a Flash Drive.

2. Hit F8 on startup to choose Safe Mode with Command Prompt.

3. Once the prompt comes up, you should be able to use Ctrl+Alt+Del and access the Task Manager.

4. Open the Task Manager and click on File > New Task (Run).

5. Type in 'iexplore.exe' to open up an explorer window.

6. Use the address bar to navigate to your Flash Drive.

7. Without an active internet connection you cannot update the definitions. Go to another machine and install Malwarebytes and update the definitions.

8. On that machine navigate to C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\ and copy that rules.ref file onto the Flash drive and return to the machine that is infected.

9. On the infected machine navigate to C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\ and copy/replace the updated rules.ref on that machine.

10. Then go to C:\Program Files\Malwarebytes' Anti-Malware on the infected machine and run mbam.exe

11. The virus definitions should be up to date, and you should run a Full Scan on the machine.

12. When the scan is completed to can remove the files and restart the machine.

That is what worked for me. Hopefully it can help someone else with this variation.

#7 Adam R.

Adam R.

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:07 PM

Posted 08 March 2010 - 02:24 PM

Everything being described here is exactly what is going on with my father-in-law's computer. Thanks slum for the walk through. I will have to call him later to see if this will work. :thumbsup:

#8 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:10:07 PM

Posted 08 March 2010 - 05:14 PM

Hello :thumbsup:

Note:
Per Tigger93 (Moderator on the Malwarebytes' forum):
"You should never run Malwarebytes in Safe Mode unless you cannot run it in normal mode. "
source: http://forums.malwarebytes.org/index.php?showtopic=9991

It is not my intention to point you in the direction of a removal guide that is not relevant to your problem.
The Malwarebytes' forum has a removal guide for Virus Protect as well:
Removal instructions for Virus Protector
http://forums.malwarebytes.org/index.php?showtopic=42377

This is a quote from quietman7 (Global Moderator on this site):
"Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware."

After you reboot the computer into normal mode, you may want to check for updates, and scan again with Malwarebytes'.

When you reply back, please include the Malwarebytes' scan results.
Copy/paste the ENTIRE CONTENTS of the Malwarebytes' scan results logs into your next reply.
Also, please state what symptoms, if any, you are still experiencing.

I am not authorized to help with logs.
"only trained members of the following groups: Malware Response Team, Malware Study Hall Senior, Moderators or Administrators are allowed to help people with logs."
source: http://www.bleepingcomputer.com/forums/t/126946/a-reminder-to-our-members-regarding-malware-logs/
If we don't change the direction we are going,
We are likely to end up where we are headed.

#9 matthewdf

matthewdf
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:10:07 PM

Posted 12 March 2010 - 03:29 PM

Well, I really appreciate the information given. None of it worked and I ended up giving in and reloading the computer. Slumslum, it was nice to see that you understood what I was saying. I hope that this helps others out.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users