Help needed, PC infected

psp83 · Oct 19, 2011, 12:51:44

Hi All..

I need some advice.

One of my work colleague did a google image search and manage to get the PC infected.

MSE wouldn't remove the infection, I've tried 4 other AV's and 3 Malware removers and none touched it.

So, I've reformatted the PC today buy tapping F8 to get into recovery mode (has a recovery partition, its a dell pc) did a restore to factory image..

I've re installed the AV, Installed firefox, done a google search and everytime I click on a link, I get taken to a random website.. So, it looks like the PC is still infected after a reformat..

Any ideas what to do next?

Rik · Oct 19, 2011, 12:53:33

Have you tried safe mode and an AV scan from there, Paul?

psp83 · Oct 19, 2011, 12:58:51

Yep. Couldn't load half the programs in safe mode & when we got one loading it still couldn't remove it.

The infection set most things to be hidden as well.

psp83 · Oct 19, 2011, 13:14:02

I think a complete wipe of the hard drive and re install is needed $:-\$

Simon · Oct 19, 2011, 13:16:20

I nearly fell foul of one of those searching for a simple birthday gif image. Luckily, F-Secure caught it. Have you tried their online scanner?

psp83 · Oct 19, 2011, 13:25:38

Quote from: Simon on Oct 19, 2011, 13:16:20
I nearly fell foul of one of those searching for a simple birthday gif image. Luckily, F-Secure caught it. Have you tried their online scanner?

I'll give it a try but doubt it will work..

The computer is not letting window update install updates as well $:-\$

Simon · Oct 19, 2011, 13:29:51

Can you backup the data? Sometimes a full format and reinstall is quicker than fiddling about trying to fix things.

Simon · Oct 19, 2011, 13:30:41

Oh, just a point, have you deleted the system restore folder, in case the virus is lodged in there?

psp83 · Oct 19, 2011, 13:41:27

Where is the system restore folder on windows 7?

Also, Would an OEM key / licencse work on a full Windows 7 disc bought from a shop?

These computers didn't come with any discs, all the recovery options are on a partition, I tried re install from the partition and its still infected $:-\$

Simon · Oct 19, 2011, 13:47:14

Can't answer either of those questions, sorry.

Glenn · Oct 19, 2011, 13:56:06

You can recover the existing licence key from the pc using SIW from http://www.gtopala.com/

The recovery partition is normally a hidden partition on the drive, have you tried formatting the C drive, then re-installing from the recovery partition?

tehidyman · Oct 19, 2011, 14:10:12

Are you getting a message to tell you it is infected ? It may be it is really one that tries to sell you a removal program. If so a Google search of the message may lead to a route to get rid of it. I recovered from such an episode (MS Removal) with help from Idnetters. If you post the message help may arrive.

http://www.idnetters.co.uk/forums/index.php/board,19.0.html

http://www.idnetters.co.uk/forums/index.php/topic,25537.msg607303.html#msg607303

psp83 · Oct 19, 2011, 14:13:54

Quote from: Glenn on Oct 19, 2011, 13:56:06
You can recover the existing licence key from the pc using SIW from http://www.gtopala.com/

The recovery partition is normally a hidden partition on the drive, have you tried formatting the C drive, then re-installing from the recovery partition?

I've found the sticker on the back of the PC with the Key on now, hopefully that should work if I have to use my own Windows 7 disc from home.

If f-secure doesn't work I'll try just reformatting C drive.

psp83 · Oct 19, 2011, 14:14:27

Quote from: tehidyman on Oct 19, 2011, 14:10:12
Are you getting a message to tell you it is infected ? It may be it is really one that tries to sell you a removal program. If so a Google search of the message may lead to a route to get rid of it. I recovered from such an episode (MS Removal) with help from Idnetters. If you post the message help may arrive.

http://www.idnetters.co.uk/forums/index.php/board,19.0.html

MSE reported Win32.FakeSysdef & another one that I can't remember.

tehidyman · Oct 19, 2011, 14:20:15

May be worth a look

http://www.spotnblog.com/solution-how-to-remove-infection-win32fakesysdef/

psp83 · Oct 19, 2011, 14:29:33

Quote from: tehidyman on Oct 19, 2011, 14:20:15
May be worth a look

http://www.spotnblog.com/solution-how-to-remove-infection-win32fakesysdef/

We run Malwarebytes at work already, had no luck with it, but I will run NPE and see what that comes up with.

Simon · Oct 19, 2011, 14:32:05

Prevex might be worth a try too.

psp83 · Oct 19, 2011, 14:39:44

MSE has reported this now : Trojan: DOS/Aureon.c

Technical Ben · Oct 19, 2011, 15:40:51

Here is the details for the removal of the other one you posted. One of the problems it, it's a "rootkit" and can hide very well.
http://support.kaspersky.com/viruses/solutions?qid=208280684

The Alureon.c seems to be of a related family of Trojans. So it might get caught by the same search.

The quickest and easiest way, is to backup documents/folders/files needed to an external drive. Completely formate or restore to a previous (clean) system image, and start again. Make sure to scan the old documents as well.

sobranie · Oct 19, 2011, 16:29:08

Sounds like that 'MS Removal Tool does it not.
I'd love to get my hands around the neck of the instigator

See here also:
http://www.wiki-security.com/wiki/Parasite/MSRemovalTool

psp83 · Oct 19, 2011, 19:08:01

Finally got the PC clean..

It took F-Secure online scanner and Norton Power Eraser to do it.

Norton Power Eraser also repaired the MBR and removed the proxy details it added to the PC.

So............. What's a good AV? as MSE doesn't seem to be doing its job. I personally use NOD32 but that's gone down hill..

Simon · Oct 19, 2011, 19:27:23

I use F-Secure, hence my recommendation.

Gary · Oct 19, 2011, 23:59:44

Prevx as as paid version, maybe something like Avira, although it does have some high false positives it is good, but using something like Sandboxie would work wonders.

Technical Ben · Oct 20, 2011, 09:06:12

Quote from: psp83 on Oct 19, 2011, 19:08:01
Finally got the PC clean..

It took F-Secure online scanner and Norton Power Eraser to do it.

Norton Power Eraser also repaired the MBR and removed the proxy details it added to the PC.

So............. What's a good AV? as MSE doesn't seem to be doing its job. I personally use NOD32 but that's gone down hill..

That's why the virus is soooooo nasty. It hides in places like the MBR (forbidden territory to most programs). It's like a thief turning up with scuba gear, and hiding in your hot water tank!

Quote from: Gary on Oct 19, 2011, 23:59:44
Prevx as as paid version, maybe something like Avira, although it does have some high false positives it is good, but using something like Sandboxie would work wonders.

PS, does sandboxie work on Win7? I've yet to find one? (Although Win 7 is "suppose" to sand box software. I guess the likes of IE gets elevated privileges anyhow...

)