Reappearing Fake Alert virus

[stevewis]

I have tried running "Stinger" in an attempt to eliminate an apparent virus to no avail, and other scans performed in McAfee do not show any issues.

I then tried Microsoft Security Essentials which has identified and performed the following action:

"Rogue:Win32/FakeRean"  --  Quarantined

"Trojan:Win32/Alureon.FE"  --  Removed

"Rogue:Win32/FakeRean"  --  Removed

"Rogue:Win32/FakeRean"  --  Removed

Although the virus is removed by Microsoft Security Essentials, it appears again at restart.

I am not making progress with this issue and have been troubleshooting for 1 1/2 days with this issue.  Are there suggestions or  assistance available in this forum?  I am running WindowsXP Professional. Please help?   thanks 

[Peacekeeper]

Are you sure you used the fake alert stinger here

http://www.mcafee.com/us/downloads/free-tools/fake-alert-stinger.aspx

Ensure all temp and internet temp files are cleaned out and disable system restore. You did try a restore point prior to when all this happens I assume.

Run getsusp to see if it detects unknown files add your email addy to its preferences so Mcafee can contact you.

http://downloadcenter.mcafee.com/products/mcafee-avert/GetSusp/GetSusp.exe

Then download and run Malwarebytes

Malwarebytes Anti-Malware (Free)

Download the free version here: 

http://www.malwarebytes.org/products/malwarebytes_free

Do not accept the offer to enable paid version as it clashes with Mcafee.

I will move this thread to the threat area the stinger bods will be interested

[judithk]

I finally got rid of the thing by logging onto my computer in the safe mode (press F8 when starting up) and using system restore to restore my computer to a time before this trojen was installed.  Before I did this nothing would work in the normal mode.  Not System Restore, Not McAfee; I couldn't delete the verson of Microsoft Security Essentials that this trojen placed on my computer,;I couldn't get onto the internet or read my e-mail.  Now everything works, Microsoft Security Essentials is gone and I haven't been bothered by those pesky warnings and messages.    

[Peacekeeper]

That is great I suggested the restore option but forgot about trying safe mode.

I would still run the software I suggested though.

[stevewis]

I did a restore which was successful, but the virus reappeared shortly after I accessed my email.  So I shut down, did another restore, and then restarted in safe mode but was unable to open my browser, and spent several hours restablishing a connection and finally was able to access email through safe mode with the information that was provided.

With this information (above) I was able to locate the malwarebytes anti-maleware from the link provided, and used it to scan and remove the item.   I have yet to get ahold of the "stinger" and have had problems getting Macafee to run, which I believe may have been a result of the virus. So for now, after using the malewarebyes free download, I have made progreess, restarted in safe mode, and have been able to get into email and back to this forum.  Thank you both for the information.  I will confirm if this appears to have been successful after restarting and working with other areas of the computer.  For now, deep breath,and need to get away from this situation which appears to have stabalized, for now...thank you much for getting me to this point.

[stevewis]

Tony,

After running the anti-maleware, would you suggesst I still download and run the "stinger" application?  

Regards,

Steve

[Peacekeeper]

Yes  it and getsusp might detect something that Malwarebytes missed or visa versa.

These malwares might corrupt a mcafee install so it might be necessary to reinstall soon if it still appears flakey.

See how things go.

Reinstall via

http://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS100507