2 replies to this topic

[D50NetAdmin]

So yesterday I get two fake spyware infections. The first was AV2009. I was called in soon enough that a system restore a few days back fixed it up. The second was a new one I haven't seen till now called Antivirus 360. Basically the same kind of fake spyware infection. This time though, the teacher believed it. clicked all over it, rebooted several times before notifying me of a message about having 35 infections. Needless to say sys restore didn't work and it was so bad that after downloading MBytes (my personal first line of defense at work for these kinds of issues btw ) I tried to update it and it would just close the update. If I tried to scan, it would close the scan. So I went into safe mode and was able to run the scan logged in as the admin. It found 30 items, but they were all mywebsearch. Darn. So then I tried safe mode with networking. I connected via our wireless and was able to update and re-scan. Many more items found, this time 360 is listed. I removed all and rebooted. Everything appeared to be fine.....at first. The first thing I noticed was that when I went to Google, it had a box notifying me of a unregistered version of AV 360 installed and that I should activate it. Nice....looks like part of Google. I started messing with IE add-ons, but didn't see much. Next thing I know I get an about:blank page with a link in it to activate AV 360. Ran another full scan and nothing found. Came to here and found this link under removal instructions: http://www.malwareby...?showtopic=8412 . While it seems to stop most of the attack, it still is leaving my browser hijacked. Any ideas on how to finish this thing off for good? Don't really want to backup, wipe, and reimage it unless I have to.

ps - tried to do a search first, but kinda hard to search on Antivirus 360 since I get an error about being under 4 chars

[GT500]

If the computer is running Windows XP, ComboFix will often help out.

Is this your personal computer, a customer's, or one at your office?

[D50NetAdmin]

The Combofix seems to have gotten rid of the last remnants. Google looks like the Google I know again. Thanks for the tip!