HELP VIRUS

[Ace Gunman]

I need serious help. I'll update in a moment. There's a virus on my PC and it's causing havok.

 

[Ace Gunman]

Okay, whatever it is had installed at least two .exe files. gNdu.exe and lWqs.exe. It keeps blue screening me, killing my antiviruses and anti-spyware programs and it has replaced my background with a fake virus message.

EDIT: I think it's cancelling out my searches on the matter as well.

 

[JPH]

Assuming you're running Windows...

Reboot your computer and run in Safe Mode or Last Known Good Configuration.

 

[Dominator]

ok ok calm down, reboot in safe mod, delete suspcious programme and restore to yesterday for example

 

[Ace Gunman]

Will do, one moment. I wouldn't have usually come to GBAtemp for help and would have dealt with it by myself, but, yeah. The whole search blocking thing lol

 

[hankchill]

You could toss it and buy a Mac? hyuk hyuk

I kid.

 

[Urza]

You could toss it and buy a Mac? hyuk hyuk

I kid.

He could keep it and install OSX86, saving hundreds of dollars on overpriced hardware? hyuk hyuk

I kid.







(not really)

 

[Dack]

Sounds like the usual fake antivirus 2008/9 virus. Download and run:

http://www.malwarebytes.org/

It will fix it.

If it's stopping you getting to their website then go via: http://anonymouse.org/

 

[Mr. Waffle]

Try Hitman Pro?

 

[Ace Gunman]

Ok guys, this is bad. Very, very bad. It won't even delete it in safe mode. It blue screened me there too.

EDIT: Oh, and there's another file. lphc395j0ee2a.exe

 

[Sinkhead]

My mate's dad got this virus and I spent a day there (I wasn't dragging the job out so I could stay at his house for BBQ chicken tea, honestly!) and couldn't fix it. I tried literally everything, and I took my laptop as well so I could search.

The virus in question was the 'Antivirus 2008/9' mentioned by Dack above. Have you already tried his advice?

 

[Trolly]

Well, if it keeps on blue screening and doing in your anti-virus programs, just back up the safe stuff on an external hard drive or USB stick as quickly as you can, then re-format your hard drive and re-install Windows. Will save you ages of faffing about, I guarantee.

 

[Mazor]

Linux live cd.

 

[omatic]

This sounds somewhat complicated, and I don't know if you'll be able to pull it off in time, but if you download an ISO distribution of Ubuntu Linux (there is one found here), and set your BIOS to boot from CD first, you can boot in Ubuntu, access your C: drive (or whatever drive it is), and delete the files. That's how I solved my last uber-virus hostile takeover.

Edit: Aw man, Mazor beat me to it while I was typing.

 

[Ace Gunman]

My mate's dad got this virus and I spent a day there (I wasn't dragging the job out so I could stay at his house for BBQ chicken tea, honestly!) and couldn't fix it. I tried literally everything, and I took my laptop as well so I could search.

The virus in question was the 'Antivirus 2008/9' mentioned by Dack above. Have you already tried his advice?
I'm about to try it, if it lets me.
QUOTE(Trolly @ Sep 21 2008, 06:40 AM) Well, if it keeps on blue screening and doing in your anti-virus programs, just back up the safe stuff on an external hard drive or USB stick as quickly as you can, then re-format your hard drive and re-install Windows. Will save you ages of faffing about, I guarantee.

This isn't a possibility for me. I don't have an external drive or USB stick, I've never re-formatted my harddrive before, and I can't re-install Windows as I have no idea where the disc is (or if my PC even came with it to begin with).

The odd thing is, I don't know how I got this. All I was doing at the time of infection was visiting IGN and talking to someone on MSN.

 

[Athlon-pv]

sometimes renaming a virus can kill it as well usually it gets called someplace by the exact filename , the only exception is when you rename the wrong file some keep creating random filenames.

i think you can use MSconfig to check your registry for which files are starting, i use spybot for this tho ....

And see if you can startup from something like a floppydisk that is if you have a fat32 partition

. If not the linux live cd makes sense....

 

[DarkRey]

try this software
http://spywarefiles.prevx.com/RRADFE12815179/2SKT.EXE.html

it might work

 

[Ace Gunman]

I'm off to try the malwarebytes link program. I'll be back if things continue to go down hill. Oh, question. Can this be installed in safe mode?

 

[Dack]

It would be a bit pointless as the virus runs in safe mode anyways.

To manually remove it is a complete pain - it attaches itself to explorer.exe etc.

The malwarebytes program will fix it.

The way I got this virus a few weeks ago was due to a drive by download from a flash advert on a website - it's a bug in adobe thats being utilised.

 

[sconethief]

NUKE IT NUKE IT NUKE IT!!!!!!!

that's all i can think of, is for you to format the HDD try and get important files off your comp first D :