Malware removal

Hi,
my daughter uses Windows Vista on her laptop. Today, pop-up windows
appeared, telling us we needed to buy an antivirus program. I had had the
problem once in December. I tried to use the files which I had received then
but this malware won't let me run the mbam file, saying it is infected. Can
you please help?
thanks

Nathalie Freeman
Le Nozach Translations

703-815-8238

"N. Freeman" <> wrote in message
news:#...
> Hi,
> my daughter uses Windows Vista on her laptop. Today, pop-up windows
> appeared, telling us we needed to buy an antivirus program. I had had the
> problem once in December. I tried to use the files which I had received
> then but this malware won't let me run the mbam file, saying it is
> infected. Can you please help?
> thanks
>
> Nathalie Freeman
> Le Nozach Translations
>
> 703-815-8238
>
>
Try Booting into Safe Mode, then give Malwarebytes a try. Also, see if you
can download and install Superantispyware and run it.

--

"Don't pick a fight with an old man.
If he is too old to fight, he'll just kill you."

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

Reboot.


--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
http://www.microsoft.com/protect

"N. Freeman" <> wrote in message
news:%...
> Hi,
> my daughter uses Windows Vista on her laptop. Today, pop-up windows appeared,
> telling us we needed to buy an antivirus program. I had had the problem once in
> December. I tried to use the files which I had received then but this malware
> won't let me run the mbam file, saying it is infected. Can you please help?
> thanks
>
> Nathalie Freeman
> Le Nozach Translations
>
> 703-815-8238
>
>

I downloaded the 2 programs on a zip drive from my non-infected laptop. Then
I tried to install them on the infected computer but the virus attacks the
programs before I get a chance to run them. Do you have any other
suggestion?
thanks

--
Nathalie Freeman
Le Nozach Translations

703-815-8238


"Peter Foldes" <> wrote in message
news:...
> Download, install, run, update and perform a full scan (separately) with
> the
> following two applications (freeware versions are the ones to use for
> this):
>
> SuperAntiSpyware
> http://www.superantispyware.com/
>
> MalwareBytes
> http://www.malwarebytes.com/
>
> After performing a full scan with one and then the other and removing
> whatever they both find completely, you may uninstall these products,
> if you wish.
>
> Download and run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> Reboot.
>
>
> --
> Peter
>
> Please Reply to Newsgroup for the benefit of others
> Requests for assistance by email can not and will not be acknowledged.
> http://www.microsoft.com/protect
>
> "N. Freeman" <> wrote in message
> news:%...
>> Hi,
>> my daughter uses Windows Vista on her laptop. Today, pop-up windows
>> appeared, telling us we needed to buy an antivirus program. I had had the
>> problem once in December. I tried to use the files which I had received
>> then but this malware won't let me run the mbam file, saying it is
>> infected. Can you please help?
>> thanks
>>
>> Nathalie Freeman
>> Le Nozach Translations
>>
>> 703-815-8238
>>
>>
>

On 08/12/2010 07:43 PM, N. Freeman wrote:
> I downloaded the 2 programs on a zip drive from my non-infected laptop.
> Then I tried to install them on the infected computer but the virus
> attacks the programs before I get a chance to run them. Do you have any
> other suggestion?
> thanks
>
Install, update and run malwarebytes in safe mode with networking. That
should clean enough malware out to then allow the install, update and
running of superantispyware in normal mode. When done with that, rerun
malwarebytes in normal mode.

--
norm

Peter Foldes wrote:
> Download, install, run, update and perform a full scan (separately)
> with the following two applications (freeware versions are the ones
> to use for this):
> SuperAntiSpyware
> http://www.superantispyware.com/
>
> MalwareBytes
> http://www.malwarebytes.com/
>
> After performing a full scan with one and then the other and
> removing whatever they both find completely, you may uninstall
> these products, if you wish.
>
> Download and run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> Reboot.

*grin*

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Thanks for your help. It finally worked (I also changed the internet
connection options back to no proxy since it had been 'highjacked', which
gave me my access back to internet and I found the name of the program
running this malware, so I was able to stop it in the task manager menu
before running the malwarebytes program. I don't know if these two steps
were necessary if I had try to run the programs in safe mode first but it
did the trick.

thanks again
Nathalie

--
Nathalie Freeman
Le Nozach Translations

703-815-8238


"Shenan Stanley" <> wrote in message
news:...
> Peter Foldes wrote:
>> Download, install, run, update and perform a full scan (separately)
>> with the following two applications (freeware versions are the ones
>> to use for this):
>> SuperAntiSpyware
>> http://www.superantispyware.com/
>>
>> MalwareBytes
>> http://www.malwarebytes.com/
>>
>> After performing a full scan with one and then the other and
>> removing whatever they both find completely, you may uninstall
>> these products, if you wish.
>>
>> Download and run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> Reboot.
>
> *grin*
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>

Shenan

LOL. Easier to copy\paste. I get lazy sometimes. :-)

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
http://www.microsoft.com/protect

"Shenan Stanley" <> wrote in message
news:...
> Peter Foldes wrote:
>> Download, install, run, update and perform a full scan (separately)
>> with the following two applications (freeware versions are the ones
>> to use for this):
>> SuperAntiSpyware
>> http://www.superantispyware.com/
>>
>> MalwareBytes
>> http://www.malwarebytes.com/
>>
>> After performing a full scan with one and then the other and
>> removing whatever they both find completely, you may uninstall
>> these products, if you wish.
>>
>> Download and run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> Reboot.
>
> *grin*
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>

On Thu, 12 Aug 2010 11:37:20 -0400, N. Freeman wrote:

> Hi,
> my daughter uses Windows Vista on her laptop. Today, pop-up windows
> appeared, telling us we needed to buy an antivirus program. I had had the
> problem once in December. I tried to use the files which I had received then
> but this malware won't let me run the mbam file, saying it is infected. Can
> you please help?
> thanks
>
> Nathalie Freeman
> Le Nozach Translations
>
> 703-815-8238

Now that you're running again, I can safely point out (gently, I hope) that
you were scammed. This is also for anyone else who reads this and hasn't
had the experience or doesn't know about it.

Those pop-ups are malware. They are very scary when they pop up, and very
convincing, unfortunately.

My preferred method to kill them is to press Alt-F4 (when the pop-up is
highlighted), or to completely exit the browser, and I absolutely avoid
clicking in the pop-up window.

--
Gene E. Bloch (Stumbling Bloch)

"Gene E. Bloch" <not-> wrote in message
news:t4uct0ijshm2$....
>
> Those pop-ups are malware. They are very scary when they pop up, and very
> convincing, unfortunately.

It's either convincing or scaring the hell out of the user to a point that
they don't want to use the PC any longer. My relative got one of these
malware recently (Antivir Solution Pro - it's malware, it's not the real
Avira Antivir software). She got so scared. She turned off her notebook
computer (of course her PC is infected already). She then called me and
asked me to have look at it on the weekend.

> My preferred method to kill them is to press Alt-F4 (when the pop-up is
> highlighted), or to completely exit the browser, and I absolutely avoid
> clicking in the pop-up window.

Alt F4 = close the window, correct? Won't that trigger a "close" event where
the programmer may insert the payload (codes) in the "close" event?

My preferred method is to pull up Task Manager and End Task the pop up
window. That'll crash the pop-up window. Turning off the computer without
clicking anything may be a good approach too.