'XP Antivirus' Virus

Question

I am a fairly inexperienced computer user with a computer virus. The virus disguised itself as "XP Antivirus update" and was downloaded to my desktop.

The virus has disabled Macafee and has blocked my ability to get to the internet. I have tried several times to uninstall but it will not.

Any suggestions on how to get this thing off my computer?

Thanks!

ky331 · Answer

Note:  since you cannot access the internet on your bad machine, download the suggested program onto another/good machine, then transfer it [via memory stick or CD-R/W] to the bad machine, run the installer and program on the bad machine [even if you can't search for updates there]. .  if you have  Windows 2000/XP/Vista: download and install the FREE version of   MalwareBytes Anti-Malware [MBAM] http://www.malwarebytes.org/mbam.php  . check for updates .  run a QUICK scan and allow it to REMOVE/QUARANTINE any items it finds. . let us know the results.   this may only be a first-step, in which case, we can then offer some follow-up suggestions.   Message Edited by ky331 on 08-25-2008 10:59 AM

mckinn1avon · Answer

I attempted to down load MBAM suggested below using a flash drive, but recieved an error message.

Run-time error '372'

Here is the complete message:

"Failed to load control 'vbalGrid' from vbalsgrid6.ocx. Your version of vbalsgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application."

Any ideas?

Thanks,

ky331 · Answer

let's try the following [exactly as specified] to see if something was "corrupted":

1. erase the mbam-setup.exe (installer) from your bad machine, your good machine, and the flash drive

2. UNinstall the version of MBAM that you currently have on the bad computer.

3. REBOOT [ReStart] the bad system. (do NOT skip this step)

4. on your good machine, click on the following link, to download MBAM again

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

5. transfer this file to your flash drive, and move it over to your bad computer

6. try installing/running it again on the bad computer, and see what happens this time.

If you still have the problem, I will have to investigate the matter further.

mckinn1avon · Answer

I followed the directions below and had the same problem. It got to the "finishing Installation" stage and then I recieved the message: "Run time error '372'

"Failed to load control 'vbalGrid' from vgbalgrid6.ocx. Your version of vbalsgrid6.ocx may be out dated. Make sure you are using the version of the control that was provided with you application."

One note, the flash drive was not recognized on "my computer" screen. I had to load MBAM through the "add or remove program" then "add new programs". I chose the add a prgram from CD-Rom option and MBAM came up as an option.

Any other suggestions?

Thanks for your help

ky331 · Answer

I've located a reference to this 'situation'... but unfortunately, that one was never resolved :-( .  so i think it best to try a completely different approach: .  (note:  I've also invited BugBatter to join this thread, if she has any alternative suggestions for you to try)  .  Download the latest version of Trend Micro's HiJackThis (HJT) [version 2.0.2]   installer   from http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe . Save it to your Desktop. . Double-click on the     HJTInstall.exe    file you just downloaded, and click on the   Install   button, to install HJT in the suggested/default folder, C:\Program Files\Trend Micro\HijackThis . ( As part of the installation, a shortcut to the HJT   program  will be placed on your Desktop, and another shortcut in your START menu [for easy-access to using HJT in the future --- you only need to run the  program  again, but not the  installer ] ). . After installation, HJT will automatically open and start running.   [If this is your   first time  running HJT, please read and accept the EULA (End-User License Agreement)] . Click on  Do a System Scan and Save a LogFile   This will automatically open NotePad   Copy the entire file from NotePad:  EDIT/SelectAll, EDIT/Copy   Then go to the forum dedicated for HiJack This logs (**NOT** back here), and  PASTE the results there:   http://forums.us.dell.com/supportforums/board?board.id=si_hijack   Be sure to include a detailed description of any problems/errors/warnings you are encountering.   Also, please indicate the steps you've already taken, if any, in terms of running anti-malware scanners or malware removal tools.  When you submit your HJT log, please make sure the box under your text which shows 'Automatically convert carriage returns to HTML line breaks' is checked, or your log may not format correctly... it should consist of separate/readable lines, not one large 'jumble'.   Hopefully, one of the HJT experts will get to it as quickly as possible.   WARNING:  HiJack This is a VERY POWERFUL tool.  While it's  completely safe  for you to download, generate, and post your log (as described above), you should *NOT* attempt to do anything else (in particular, do NOT use it to delete/fix any entries) until you are advised to do so by a forum expert!!   Improper use of this tool can severely damage your system.

ky331 · Answer

I'm going to report your situation to the program's creator, to see what he'll suggest....

mckinn1avon · Answer

Excuse my ignorance here.

But since I do not have internet access with my infected machine, I will have to use my work laptop and then save the HJT to the flash drive and transfer it to my infected machine. Will this work?

Any chance of this harming my work computer in any way?

Thanks again,

ky331 · Answer

downloading HJT to your work machine, transferring it via flash drive, installing it on the "bad" machine, running it to generate a log on the bad machine.... is completely safe, and should work [unless your "infection" is "smart" and "knows" about programs like MBAM & HJT, and is "on the lookout" to stop them from installing or running].

copying the generated HJT log [a .TeXT file] from your bad machine onto the flash drive should be safe --- provided that's all that gets copied. HOWEVER, if you're looking for a 100% "money-back" guarantee, I'd have to admit there's a remote possibility that the malware on your bad machine, if "smart enough", might be able to transfer additional files onto your flash drive as soon as you plug it in to the bad PC. the files could be hidden... even in a separate/hidden partition created by the malware to cover things up... and if so, then upon placing the flash drive in your good machine, the infection could spread there.

perhaps BugBatter [the top malware expert participating at DELL] can offer you more information, on whether that's a "real" possibility, or something so remote as to be dismissed.

Your choice now, on how best you'd like to proceed... go for HJT now? or wait to see what (if anything) BugBatter has to say?

Bugbatter · Answer

Try downloading SAS to your USB stick and transferring that to see if it will install and run.

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (UNcheck all others.):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".

If that does not work, follow ky331's instructions to post a HijackThis log so someone can help you run a more specialized tool for targeting this type of problem.

Virus & Spyware

"XP Antivirus" Virus

Was this post helpful?