2 Replies Latest reply on Jan 12, 2011 10:12 AM by mn_finch

    Windows Security & Antivirus Alerts

      I got Windows security alert, System Tools 2011 & Install antivirus SW pop-ups. Both were identified by Stopzilla & deleted Registry.
      But then I was away from my machine when Windows security alert popped up again, and now I cannot open any appl, or, run any executable -- get runtime errors.

      I disabled System Restore and ran an old copy of stinger I had in safe mode.
      Stinger was run twice -
      (i) Report only mode, Sensitivity - Very Low
      (ii) Report only mode, Sensitivity - Very High

      Both are being included. Would you please advise on which files to delete?
      Can I delete everything reported by the stinger when ran with Sensitivity = Very Low?

       

      Also, this attack happens whenever I connect to Internet / on just leaving the machine connected -- does this suggest a more grave problem? What is the solution?

      Would highly appreciate your help.

       

      Thanks.

        • 1. Re: Windows Security & Antivirus Alerts
          Hayton

          "Windows Security Alert" is a known rogue program which has been around for a while, and so there are many sites offering fixes to help you get rid of it.

           

          Two of them are at bleepingcomputer.com and malwarehelp.org

           

          Both suggest you use Malwarebytes, but if you have problems downloading it to your PC then use another (uninfected) machine and save it to a USB device with a different name. Boot your PC into Safe Mode and run Malwarebytes from the USB device using a quick scan. That should clear out the infection, but to be on the safe side once that is completed reboot and run a full scan.

           

          I can't say anything about the Stinger results since I don't see them. Stingers anyway only target a limited subset of threats and may not pick this one up. If the Low Sensitivity stinger detected problem files you might want to rename them (replace the last letter of the extension with an underscore, so a .exe becomes a .ex_ file) and send them to McAfee for checking (see here for details).

          • 2. Re: Windows Security & Antivirus Alerts

            Thank you.

             

            Since there is the option of attaching files, I thought you might be able to see it

            If there is a way of sending the logs to you, plz let me know. In safe mode w Networking, for some reason internet did not work - but I found the email addr (malware_research@mcafee.com), and will send them the logs.

             

            Thanks again.