virus question

[Papa_Complex]

Originally Posted by tkevcu

I haven't found a whole lot about this particular one on the web, but from what I have found, it doesn't look that bad.

What version of Windows is on the laptop?

Malwarebytes and Spybot are both good programs. You can also run HijackThis and post/attach the log, and we can read through that.

It's actually pretty bad, because it constantly pops up and blocks you from being able to use your computer. It masquerades as a legitimate virus scanner. Ultimately it takes you to a website in order to download their "virus remover", which is more spyware and viral files, after you've given them your credit card number.

All in all, that's pretty bad. It's also damned tough to remove, once it has gotten to a certain state of infection. I generally use either a Windows PBE boot CD or something like BART PE, in order to boot into the system and start a manual cleaning, before I move on to the utilities that I've mentioned. That gives me about a 95% positive result, but I still occasionally have to reinstall Windows.

[tkevcu]

I've removed 4 or 5 variants of this type of virus, some of which have been more embedded than others. 1 was really devious and took every skill and utility that I had to remove it.

From what I found on the web, this one consists of a single executable existing in the temp folder, and changes to the proxy settings in IE to block traffic. Removal should be fairly straightforward (kill running exe process or use other boot media; delete the executable from the machine, and correct the proxy settings via regedit or the IE menu itself)

[Papa_Complex]

Originally Posted by tkevcu

I've removed 4 or 5 variants of this type of virus, some of which have been more embedded than others. 1 was really devious and took every skill and utility that I had to remove it.

From what I found on the web, this one consists of a single executable existing in the temp folder, and changes to the proxy settings in IE to block traffic. Removal should be fairly straightforward (kill running exe process or use other boot media; delete the executable from the machine, and correct the proxy settings via regedit or the IE menu itself)

Depends. The executable can be in the User\Temp, Windows\Temp, Windows\System32. It can set up a proxy. It can set hard coded URL references in the Hosts file. It can embed DNS override entries in the system registry. It can lock the Hosts file, so that it can't be edited. It can drop other infections. This has become the single largest part of my job, over the last 6 months; dealing with this infection and its variants.