Antivirus System PRO prohibiting use of Dell laptop

* Have you have posted this issue on another forum? If so, please provide a link to the topic.  No

* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly. OK

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.  OK

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.  The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE.  OK   

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?  OK

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. It is understood by the trained analysts that once a helper replies to a log, he continues working with you until the issue is resolved. OK

* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.  OK

* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them. OK

Welcome. Thank you for using Dell Community Forums.

Yes, most likely we can remove your Antivirus System PRO problem. It is one of the common rogues.

I am reviewing your log. In the meantime, you can help me by addressing the following:

* Have you have posted this issue on another forum? If so, please provide a link to the topic.

* If you have disabled System Restore in an attempt to begin cleaning malware, please enable it now. We will flush System Restore when we are finished cleaning and we are sure that everything is running smoothly.

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE.

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.  The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE.    

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures. Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. It is understood by the trained analysts that once a helper replies to a log, he continues working with you until the issue is resolved.

* During the course of our cleanup please do not do any additional online work or surfing until we have verified that your system is clean.

* We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.

I look forward to your reply so we can begin cleaning.

Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log at the top of this board to start a new forum topic.

Please download ATF Cleaner by Atribune. This program is for XP, Vista, and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.Under Main choose: Select All Click the Empty Selected button.
  

If you use Firefox browser

• Click Firefox at the top and choose: Select All Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser

• Click Opera at the top and choose: Select All Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program. Please download to your desktop Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked,
  Click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Notes)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report into your next reply. Also include a fresh HijackThis log.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process; if asked to restart the computer, please do so immediately.

If you encounter this message:
"c:\program files\malwarebytes' Anti-Malware\mbamext.dll
Unable to register the dll/ocx: RegSvr32 failed with exit code 0x5"
Click on ignore mbamext.dll * If you are unable to download or install MBAM on your computer, see if you can use a friend's or family member's computer to download MBAM. Use the update link mentioned above to manually update. Once downloaded, rename the program installer "mbam-setup.exe" file to something else like "mrw.exe". Copy the installer file and the update file to a CD or flash drive. Transfer the files to the infected computer. Install the "mrw.exe" file, then run the update so that you will have the current definitions. After that, run a full system scan and select to have the program REMOVE whatever it finds.

**If you need to re-install MBAM but encounter issue in re-installing, try using the MBAM Cleanup Utility by downloading it from HERE

I can scan just fine, but when I click "Remove Selected" the program seems to freeze up. It's happened twice. Also, my wireless Internet connection has completely shut off. Any suggestions? Thanks!

Try scanning in Safemode.

Can you explain how to do that?

To reboot into Safemode:
Turn on the computer.
Immediately begin tapping the F8 key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

(Note: It will take a few minutes for drivers to load. You will see the list on a black screen. Just sit back and be patient while Windows loads. Your desktop will look odd with larger icons. That is normal because you are running with a minimum amount of drivers.)

After your desktop loads, navigate to MBAM and see if it will run.
When the MBAM scan is  finished reboot normally.             

Hi! I can navigate to Safe Mode fine but after I press enter, a blue screen that says "A problem has been detected and windows has been shut down to prevent damage to your computer" pops up. I can't really seem to be able navigate away from this page, unless I restart my computer and start this process all over again.

Okay, let's try this:

McAfee interferes with many of our tools -- especially the next one. We'll need to disable McAfee. If that does not work, please uninstall McAfee. (If you have the CD's, or use McAfee Support,  you can re-install it once we have verified that the computer is clean.)

• Please open McAfee Security Centre
• Under Common Tasks click on Home
• Click Computer Files
• Click Configure
• Make sure the following are disabled by ticking the "Off" button.
• Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)
• Next, select never for "When to re-enable real time scanning"
• and click OK.

Further info on disabling and re-enabling McAfee: http://help.aol.com/help/microsites/microsite.do?cmd=displayKCPopup&docType=kc&externalID=222820

Download Combofix from any of the links below. Rename it to mrw7391.exe
You must rename it before saving it.

Save it to your desktop.

Link 1
Link 2
Link 3

Double click on mrw7391.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

Hi, bigdad1 here,

i am experiencing the same problem. I have dell dimension 2400, and with Mcafee security not working for me. I have the same pop-up's from windows security alert and Pro system alert. I do not want perchase another securty system then what I ailready have.

to name some it tells me I have;

virus.win32.Gpcode.ak>

email-worm.win32.NetSky.q

Net-Worm.win32.Mytob.t

Net-Worm.win32.DipNet.d

Just these are the High alerts. What can I do?

Bigdad1 here again,

I cannot open my Mcafee security page, or Internet Explorer, but I can open my Aol desk top. Can we work from there?

Bigdad1,

Please Read This Before Posting For Malware Removal Help

We'll be glad to handle your log as soon as possible. If you do not want to wait for an available volunteer analyst, I suggest posting a HijackThis log at SpywareHammer.There are instructions HERE for posting at SpywareHammer. The site has many Microsoft MVP's on staff and helpers there may be able to assist you sooner than we can here.

Additional forums that offer malware removal can be found at this link in the recommended sites section on the left side of this page: http://hjt-data.trendmicro.com/hjt/analyzethis/index.php

Please post at only ONE so you do not tie up two or more helpers working on the same issue. Thank you for your patience and understanding.