Unwanted software on the PC - virus like

[Boncuk]

Hi All,

some of these days I received an email offering a short film about Angelina Jolie. (Who doesn't want to see her?)

Reading properly I should have noticed the type mismatch saying "Anjelina Jolie".

I clicked the link and there it was: a program named "Antivirus xp 20008". I uninstalled it and with the next start of the PC it was gone. (I thought)

After one hour of operation there it was again, this time having created a new folder.

The first thing it does is disabling the wall paper selection and screen savers for a good reason: It wants to remind you to register showing its own wallpaper (bright yellow and very ugly blue).

Going to any URL the program asks every time: "Do you want to proceed without real time protection?" and even navigating at one site it comes up with that annoying question taking you back where you came from.

It takes some work to get rid of this obvioulsy virus-like acting software with its extremely aggressive marketing method.

I cleaned up the registry first, started the system in DOS-mode and deleted all relevant files. The software has gone, however the desktop wallpaper still shows up which I overwrite using "Cool wallpaper"

Don't click Anjelina Jolie!

Hans

 

[killivolt]

It was brad.

I think he's jealous.

On second thought it was her.

She doesn't want men to think of anyone but her.

kv

Get her outta my mind.

 

[colin mac]

Bleepingcomputer have a guide for removing it.
https://www.bleepingcomputer.com/malware-removal/remove-antivirus-xp-2008

 

[Boncuk]

Hi Colinmac,

thanks for the advise. The link towards the instructions won't work.

Hans

 

[Torben]

Hi Colinmac,

thanks for the advise. The link towards the instructions won't work.

Hans

Very odd. . .it works for me. There is an off chance that the virus remains and that it is blocking that page.

If you like I can email you the instructions and the removal tool.


Torben

 

[Krumlink]

Look in the C drive for any strange files. I had a similar virus when I was trying to get Garry's Mod 9. It was hiding in the program files.

 

[colin mac]

You can check the XP hosts file at

c:\windows\system32\drivers\etc\hosts

to see if the url has been added to it by the virus

 

[Boncuk]

Unwanted software on the PC

Hi Torben,

I deleted all related files last week except for the wallpaper which I couldn't find since I don't know it's name. (Wallpapers and screensavers remain blocked after deletion). The program seemed to be gone.

Yesterday the program installed itself with a full folder entry (was deleted
too) and all necessary exe files and dlls. (The uninstall file doesn't change a thing.)

The folder's name is "rhccrhj0e3an".

I tried bleeping computers again, but can't get the instructions to clean up.

I guess it would be best if you send me the instructions via email as you kindly offered. Please send to hjzelecii@freenet.de.

Thank you very much in advance.

Regards

Hans

 

[Hero999]

Let this be a lesson for you, never read emails form people you don't know especially if the look like they might contain p0rn.

 

[dknguyen]

Why would you read a spam e-mail of any kind? Whether or not it was spelled correctly?

 

[TRexall]

The lesson here is..never open attachments from people you don"t know...even a famous hollywood star.

 

[Torben]

Hi Hans,

Check your email. I hope it works for you.


Torben

 

[HiTech]

There are numerous websites with info. on how to rid this malware. It's not really a virus-- more like a nasty spyware/malware. My daughter's 'puter had it a couple of weeks back and yes it's a PIA to get rid of. It even side-stepped Norton and AdAware Pro. Once I managed to get to the desktop, I then installed both AVG free AV and Spybot S&D. Updated those and ran their FULL SYSTEM scans. They caught numerous replications of that garbage malware and removed it. Then I updated Norton and AdAware Pro. Everything runs smoothly now.

 

[Mikebits]

One recommendation. When running your scan like spybot and such. Do it in safe mode.

 

[Boncuk]

Why would you read a spam e-mail of any kind? Whether or not it was spelled correctly?

I'm afraid I can't say SPAM from normal emails. Anti-SPAM software can be paid mostly with a credit card only - which I don't have. To get a credit card I'd have to fly to Germany, reside in a hotel, rent a car and obtain the credit card at my bank showing up in person.

Flight including all other expenses would take more than 2,000€ (~3,000US$).

PayPal and Click&Buy payment systems are safe and I really wonder why many selllers don't make use of them.

Hans

 

[TRexall]

I had a bad virus once..and even spybot Sand D didn't help...nor did going into "Safe-Mode",,,had to run "Smitrem" first..then delete the stuff the virus left behind..strange files looked like hebrew lettering..0kb files..then use Unlocker Assistant to unlock the files because Winderz wouldn't let me delete them.

 

[Mikebits]

I don't think spybot is a virus checker.

 

[TRexall]

True ..it"s mostly an Adware,Spyware checker,but if you use the "Tea Timer" it will prevent certain changes to your computer files.

 

[Mikebits]

Hey Boncuk, can you go this site?
https://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

If you can DL the Hijackthis program, run it in safe mode and generate a file, but don't do anything yet. Post the generated file here, and we can take a looksee for ya. Maybe we can spot a few things to help

 

[Boncuk]

Unwanted software on the PC

Hi All,

the problem seems to solved.

Thanks to Torben's suggestion I installed malwares' ANTI MALWARE.

Antivirus xp 2008 had already done a pretty good job, multiplying itself in 226 files.

ANTI MAlWARE killed them all. No more annoying fake virus attack messages, wallpaper and screensavers are back again (were hijacked)

The above mentioned software is freeware, but only scans as freeware version (no removal of malware). Lots of payment options allow instant use of the program in its full version.

Maybe this software is good to protect German PCs against the government initiated "Federal trojan", meant to spy on potential terrorists. (HaHa).

Kind regards to everybody for his help in this matter.

Hans