Malware Issue

[royalscot]

Hi , I had a malware alert last nite and subsequently quarantined the blighter .

When i came onto my pc this evening i couldnt acces any of my files from my desktop ....The following message was displayed

Choose the programme you want to use to open this file .

I take it theres a problem with the task manager

 

Any thoughts please , regards rs

[SOD'EM]

Can you start the Task Manager? Sounds like there are more than one little blighters.

 

Download and install Malware Bytes (free) and do a full scan. Post the results when you have them. There are many more things to do afterwards, but if you can connect to the internet, then that would be my first move.

 

PS. What AV are you using at the moment?

[dx100uk]

Hi , I had a malware alert last nite and subsequently quarantined the blighter .

When i came onto my pc this evening i couldnt acces any of my files from my desktop ....The following message was displayed

Choose the programme you want to use to open this file .

I take it theres a problem with the task manager

 

Any thoughts please , regards rs

 

thats a typical offshoot of a trojan horse virus that has part deployed

your AV prog has not done its job properly...bet its nortons!

 

firstly do this:

Protection Center - Windows Live OneCare safety scanner

 

then

 

http://www.microsoft.com/security_essentials/default.aspx

 

and remove whatever AV you currently have

 

or SOD'EM's advice.

 

dx

[royalscot]

Hi SOD`EM , thanks for your reply

 

Yes i can get the Task Manager window to appear by right clicking the task manager

 

I cant down load anything , after i press Run , i get the same message

" Choose the program you wish to open this file "

 

I can still access the net

 

I`m using AVG 9 av

 

Many Thanks regards rs

[SOD'EM]

I am not sure what OS you are using, as you would normally have to press CTRL+ALT+DEL to start the Task Manager.

 

Try rebooting in safe mode with networking and see if that lets you connect to the internet. You can normally boot in safe mode by pressing F8 as soon as the system is starting up.

Edited March 19, 2010 by SOD'EM

[royalscot]

Hi dx , its AVG 9 not Nortons would never use Norton

 

firstly do this:

Protection Center - Windows Live OneCare safety scanner

 

Tried that and it wont let me scan " we were unable to install the scanner " must be AVG blocking it ?

 

http://www.microsoft.com/security_es...s/default.aspx

 

Cant download this ...... message " Choose the programme you want to use to open this file "

 

Never had any problems with this AV before but will look about for a new one or possibly e-mail them direct , thanks dx regards rs

[SOD'EM]

Try the Malware Bytes and do a full scan if it lets you. Your current AV will not stop it from running as it is a separate entity.

 

 

Also, when changing your AV. Either install Avast Home Edition (which I and many others prefer), or Microsoft Security Essentials (which dx and many others prefer).

 

They are both free and I have them both running simultaneously on my system. They don't seem to get in each others way. I haven't had a sniff of a virus since.

Edited March 19, 2010 by SOD'EM

[royalscot]

Hi sod`em , I m using xp pro and i can access Task Manager by using CTRL+ALT+DEL

Tried rebooting in safe mode can still access net but still cant open anything on the desktop without the following message always comin up ..... " Choose the programme you want to use to open this file "

 

As i said , I cant down load anything , after i press Run , i get the same message

" Choose the program you wish to open this file

 

i can right click and do a scan but i cant left click to open anything without that message appearing

[Tezcatlipoca]

Pft...common issue. The malware has been successfully removed, but in the process it has screwed your executable file association so Windows doesn't know how it should open a program.

 

Simple to fix with XP via registry hacks. I've written you the fix files and attached them to this post in a zip file. To execute, do the following:

 

1) Download the zip file and unzip it, either onto a USB stick ready to transfer to your affected PC or - if you can - on the affected PC itself.

2) Once the two files are on the problem PC, right-click the UnHookExec.inf file and select Install.

3) Now right-click the WinXP_EXE_Fix.reg file and select Merge.

4) Reboot your PC. Your issue is now fixed.

 

Note that these fixes simply restore the Windows file associations for executables to their system defaults (thus repairing the damage done by removing the malware). As a reuslt, they are completely safe to run in an unaffected system.

fixes.zip

[dx100uk]

tnx tez

 

you beat me

 

dx

[royalscot]

Pft...common issue. The malware has been successfully removed, but in the process it has screwed your executable file association so Windows doesn't know how it should open a program.

 

 

Now thats how i would have liked to explain my problem ..

 

Thanks ever so much Tez it worked a treat , im now running Malwarebytes and ccleaner .

 

Im a bit confused as to how this malware got through my av security ...I was told by PC WORLD that it was up there with the best AV around

 

Go for AVG 9 they said its really top class

 

Thanks also dx and sod`em

 

Regards rs

[SOD'EM]

Are PC world on commission?

 

I started of years ago with Norton, because I knew no different. The best 2 AV's out there that are free are Avast and Microsoft Security Essentials. As I said earlier, I am running both, try getting through that virus'

[Tezcatlipoca]

Im a bit confused as to how this malware got through my av security ...I was told by PC WORLD that it was up there with the best AV around

 

Quite out of character for them, PC World are actually correct here; AVG is indeed up there with the best. But that's kind of the point, it is just one of the best AV programs.

 

Avast might have caught this particular problem, but let another through, Microsoft Security Essentials might have blocked both, but failed against another threat. The point here is that no anti-virus, or anti-anything for that matter, is perfect, and every AV program is potentially vulnerable to missing an attack.

This is largely due to the fact that AV software releases are made in response to an identified threat, so they are always going to be playing catchup. Which means, of course, that thousands of users - despite their protection systems - will have gotten infected first.

 

It's easiest to think of this in terms of the biological equivilent. You get a virus, you get sick, your immune system identifies the threat and produces unique antibodies, you get well and are protected in future. AV software works in pretty much the same way. A new virus gets written, people get infected, the AV companies identify the threat, write removal scripts then everyone using that AV gets the update.

 

As to which AV is best, it's broadly a matter of personal choice, and all AV manufacturers are competing not only with the virus and malware writers but also with each other to be the first/best/most comprehensive protection system out there.

Hunt around online and you'll find endless discussions/arguments about which AV is better, but ultimately which you choose is entirely up to you. All the main freeware AV systems do a superb job at keeping you protected from the vast majority of threats and junk out there, but, ultimately, you just have to exercise a little vigilence and remember that there's no such thing as perfect protection.

 

If you're confused, why not install and run one for a few weeks, then uninstall it and try another to see which you like best. Just don't try to run AVG and Avast at the same time. Oh, and stay away from Norton and McAfee.

Edited March 19, 2010 by Tezcatlipoca

[dx100uk]

what is more to the point is that AV is anti-virus, same as avast, they dont deal with malware trojan attacks.

you should/would need a sep program to catch those.

spywareblasterfree or spybot or WHY.

MSE is a very good package that deals with both.

 

as has been said, no one package is kill all, but then again running two gets the knickers somewhat twisted [sod'em note!]

 

even if you get infected MSE can /will deal with it even after the horse has bolted.

 

the last thing here that needs saying is this:

 

99% of the time its the USER that allows these things through and NO PROGRAM is going to stop it running. esp if you are browsing the internet with an account that has ADMINISTRATOR RIGHTS.

 

thats one of the best ways to get infected.

 

ONLY even use an acount with admin rights to install stuff

 

then log out and in with limited access one

 

lesson over.

 

dx