Win 7 Fake Anti-Virus HEELP

[Judas]

okay so i'm not sure quite how i got it but i have this win 7 "anti-virus" on my laptop, and all these things started popping up and i knew it was a fake so i googled it on my phone and i was right.

basically it has blocked me from getting onto the internet via any browser i have, and it has also blocked me from opening AVG. i really need to get rid of it as i rely on the internet a lot to contact people and to revise for exams which start next month so if anyone has any ideas please help because i am screwed lol

btw i'm on my family computer at the moment, so i can download programs or whatever to transfer onto the laptop (if it doesn't block them), but i tried to use this spyware doctor thing which opened and worked fine, but it only scanned it and told me there was a virus on there but tried to make me pay to actually wipe it out so -_-

[xxMATTGxx]

Reboot the system into safe mode with networking (F8 while booting up, before the Windows logo)

Use application such as "Malwarebytes Anti-Malware" from: http://www.malwarebytes.org/mbam.php

Let that scan and see if it can detect anything.

[Judas]

if it finds anything will it get rid of it too? cos thats what this spyware doctor thing did and didn't do anything about it

edit: nvm i read the description, i'll give it a go, thanks :)

[Andy-]

This has happened to me before the anti virus goes on to your computer and wont let anything load up. I rebooted my computer then I restored my computer to it's default settings but before you do that transfer all the documents you need on to a portable USB once you have done that you can run it in safe mode then it should be working fine. Though I suggest you run your computer for any viruses after you have done this.

Matt's way is faster though.

[xxMATTGxx]

if it finds anything will it get rid of it too? cos thats what this spyware doctor thing did and didn't do anything about it

Yeah it will remove any detected stuff or try to it at it's best.

[Judas]

it won't let me install it on the laptop :/

[xxMATTGxx]

it won't let me install it on the laptop :/

What does it say?

[Judas]

nothing, i just click and it doesn't open. i tried to install it on the PC and then i copied the folder over to the laptop but it still just doesn't open, nothing happens at all

[xxMATTGxx]

nothing, i just click and it doesn't open. i tried to install it on the PC and then i copied the folder over to the laptop but it still just doesn't open, nothing happens at all

Are you safe mode?

[Judas]

yeep, with networking :/ shall i try a different one?

---------- Post added 22-04-2011 at 04:46 PM ----------

this site (http://www.2-spyware.com/remove-win-7-antivirus-pro.html) says to download this 'exefig.reg' thing they have and then use an automatic removal tool to install spyware doctor (though that didn't help at all last time) - what's an automatic removal tool?

[xxMATTGxx]

An automatic removal tool will try and remove it automatically. If you know how to workaround regedit then you could manually remove the registry values that is listed on that page.



yeep, with networking :/ shall i try a different one?

---------- Post added 22-04-2011 at 04:46 PM ----------

this site (http://www.2-spyware.com/remove-win-7-antivirus-pro.html) says to download this 'exefig.reg' thing they have and then use an automatic removal tool to install spyware doctor (though that didn't help at all last time) - what's an automatic removal tool?

[Judas]

okay i'm completely lost lol. i've got an automatic removal tool doing a full scan now, and i don't know what regedit is, but i used the exefix thing and nothing has happened

[xxMATTGxx]

okay i'm completely lost lol. i've got an automatic removal tool doing a full scan now, and i don't know what regedit is, but i used the exefix thing and nothing has happened

Regedit aka Registry Editor; This page tells you how to use it.

http://www.2-spyware.com/news/post226.html

Then the registry values for the fake anti-virus is on:

http://www.2-spyware.com/remove-win-7-antivirus-pro.html


Note: I've never used this site, just using it as you linked it.

[Judas]

i seee thank you i'll have to try it tomorrow probably as i'm going to my dads now and there will be no other computers available there but hopefully the automatic removal tool will be able to help a bit, thanks for the help

[Flisker]

This solution probably isn't what you want to hear but its probably the best option:

Backup your documents, format your hard drive, reinstall Windows and finally move all your documents back over. That is the only way you can make sure your computer is virus/spyware free since you don't know how far into the system this virus has manifested itself.

Also can I suggest using Microsoft Security Essentials if you do manage to reinstall Windows.

[Judas]

This solution probably isn't what you want to hear but its probably the best option:

Backup your documents, format your hard drive, reinstall Windows and finally move all your documents back over. That is the only way you can make sure your computer is virus/spyware free since you don't know how far into the system this virus has manifested itself.

Also can I suggest using Microsoft Security Essentials if you do manage to reinstall Windows.

ohhh dear that sounds very time consuming and confusing LOL i'll use it as a last resort if nothing else works :P thanks for the help

[Misawa]

Download software called ComboFix. Rename the file something like "arjiajfjeifj", restart your computer and run it without any other programs running on your computer. It may take a couple of tries for it to work, namely keep trying to delete rom.exe from your task manager, but ComboFix will sort it out. Once that's done, use Malware Bytes and it should work.

[Judas]

wait call which file arerefuae ? the combofix program file?

[Misawa]

Yes. You must change the filename of ComboFix to something totally random or the virus you've got will pick up on it. That's why Malwarebytes won't work, even if you change the name. It jus so happens that ComboFix is lesser known and can get past the 'defences'.

[Judas]

okay thanks a lot. one last thing, how do i know if it's "worked", like what's it supposed to do ?

[Misawa]

It will load and may take some time to do so, but a blue dos-type screen will pop up and it will say that it is attempting to fix your computer in about 30 or so stages. It may turn your computer off automatically during the fix and then once you restart it'll start where it left off. It doesn't take very long. Once it's finished, restart and you should have no more trouble with the fake anti-virus notices.

[Judas]

great, i'll try that when i get home in a bit. thanks :D

[Agnostic Bear]

Backup. Format. Reinstall. Done.