Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 Recovery Virus removal


  • Please log in to reply
9 replies to this topic

#1 ezzrider

ezzrider

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 01 May 2012 - 08:41 PM

I am brand new to this forum and just found it. I need some help. My granddaughter has the Windows Recovery Virus on her laptop. It runs with Windows 7. The Recovery Virus has disabled the McAfee Virus Scan I put on her computer and will not allow me to download and run a virus scan with McAfee. What can I do to remove this Recovery Virus from her laptop? Is there a free automatic removal tool I can download to my computer and load up on her laptop via a memory stick? I can't get this thing off of her computer.

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,561 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:38 AM

Posted 01 May 2012 - 09:29 PM

Welcome... I moved this from WIN 7 to the Am I Infected forum.

Please follow our Removal Guide here Remove Windows Recovery .
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system

How is it now?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 ezzrider

ezzrider
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 02 May 2012 - 09:15 AM

Welcome... I moved this from WIN 7 to the Am I Infected forum.

Please follow our Removal Guide here Remove Windows Recovery .
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system

How is it now?



Thanks for your assistance. The problem is with my Granddaughters laptop and not the computer on which I am connecting to the INTERNET and this website. The virus on her computer only allows about a 30 second connection to the INTERNET and then a error message comes up and knocks me off of the INTERNET. Can I download something onto my computer and save it to a memory stick to transfer to her computer? I have attempted to download the latest version of McAfee for which I already have a license and it will not properly install on her computer. I do not know how the McAfee virus scan got off of her computer and did not stop this virus. The virus apparently has complete control at this point. Any suggestions?


Her laptop has Window 7 Home Premium Service Pack 1 64 bit operating system. This was purchased new this past Christmas.

#4 ezzrider

ezzrider
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 02 May 2012 - 09:25 AM

I downloaded and saved the program to a memory stick and attempted to install it on the laptop but it will not install.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,561 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:38 AM

Posted 02 May 2012 - 09:37 AM

Is there anotheruser account on there that you can log in from and run the tools?

Or
Have you tried to Reboot into Safe Mode with Networking
How to start Windows 7 in Safe Mode and download tools


Are you getting an error message?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 ezzrider

ezzrider
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 02 May 2012 - 09:55 AM

Is there anotheruser account on there that you can log in from and run the tools?

Or
Have you tried to Reboot into Safe Mode with Networking
How to start Windows 7 in Safe Mode and download tools


Are you getting an error message?


I can try the safe mode. Only have one user assigned for her computer. I attempted to run as administrator but it would not let me. The latest error was G:\mbam-setup.exe Windows Cannot access the specified device path or flle. You may not have appropriate permission to access the item.

#7 ezzrider

ezzrider
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 02 May 2012 - 10:09 AM

I was able to start up in safe mode with networking and can access system tools. What next or is there another tools? I was able to install the malware program in safe mode via the memory stick. It will not open up however. When I checked I get an error message that mbam is incompatable.

Edited by ezzrider, 02 May 2012 - 10:19 AM.


#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,561 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:38 AM

Posted 02 May 2012 - 10:29 AM

This infection changes settings on your computer so that when you launch an executable, a file ending with .exe, it will instead launch the infection rather than the desired program. To fix this we must first download a Registry file that will fix these changes. From a clean computer, please download the following file and save it to a removable media such as a CD/DVD, external Drive, or USB flash drive.

FixNCR.reg

insert the removable device into the infected computer and open the folder the drive letter associated with it. You should now see the FixNCR.reg file that you had downloaded onto it. Double-click on the FixNCR.reg file to fix the Registry on your infected computer.


EDIT: also try to run SAS from Safe w Ntworking.

Please download and scan with SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
    For instructions with screenshots, please refer to the How to use SUPERAntiSpyware to scan and remove malware from your computer Guide.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all other options as they are set):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the Control Center screen.
  • Back on the main screen, under "Select Scan Type" check the box for Complete Scan.
  • If your computer is badly infected, be sure to check the box next to Enable Rescue Scan (Highly Infected Systems ONLY).
  • Click the Scan your computer... button.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the scan log after reboot, launch SUPERAntiSpyware again.
  • Click the View Scan Logs button at the bottom.
  • This will open the Scanner Logs Window.
  • Click on the log to highlight it and then click on View Selected Log to open it.
  • Copy and paste the scan log results in your next reply.
-- Some types of malware will disable security tools. If SUPERAntiSpyware will not install, please refer to these instructions for using the SUPERAntiSpyware Installer. If SUPERAntiSpyware is already installed but will not run, then follow the instructions for using RUNSAS.EXE to launch the program.

Edited by boopme, 02 May 2012 - 10:32 AM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 ezzrider

ezzrider
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:38 AM

Posted 02 May 2012 - 11:04 AM

I downloaded the reg fix on a memory stick on my clean computer. I put it on the infected computer and it would not open under a normal windows restart so I did a restart in safe mode with networking. I inserted the memory stick and when I clicked on the FixNCR.reg file the Window Recovery virus opened in the Safe Mode, covered the entire screen and the FixNCR would not work.

Edited by ezzrider, 02 May 2012 - 11:04 AM.


#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,561 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:38 AM

Posted 02 May 2012 - 12:30 PM

Appearse need to run the AVIRA RESCUE CD
Try creating this disk and boot off of it. You will need another computer to make this disk on.
Avira AntiVir Rescue System
Tutorial for Avira Rescue CD
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users