system error dangerous virus message

[zoe]

A "system error dangerous virus message" keeps popping up every few seconds.  I'm sure it is some type of virus.  It asks if I want to install anti-spyware.  I continue to answer "Cancel."  Does anyone know how to get rid of this annoying message?

[street1 (RIP)]

Go to the below 2 links download and use both programs.They
are free. AVG is really great freeware software.

http://majorgeeks.com/download886.html

http://www.majorgeeks.com/AVG_Anti-Spyware_d5287.html

[zoe]

I downloaded and ran both programs but neither picked up a virus.  I also had installed Norton 360, but it did not find one either.  I don't understand why these programs can miss it.  Any suggestions would be greatly appreciated.

[Dias de verano]

The answer is that you have probably picked some malware which is an "anti-spyware" scam. It warns you that you have a "dangerous virus" when you actually do not have one, so that you are induced to install their fake software which will pop up warnings, probably for "viruses" that need their paid-for version! Or else your PC will become full of adware.

[Spoiler]

Take a look though this....it will help you get started with a fix....

http://www.computerhope.com/forum/index.php/topic,46313.0.html

[patio]

You're infected....i'm moving this to the appropiate Forum.
Follow the instructions posted and post back with the logs....

[zoe]

 
Thank you so very much!  I followed the instructions and when I did the scan with Malwarebytes' Anti-Malware, the trojan virus was found!  I can't thank you enough for your help!  You guys are truly heros in a land of creeps who launch nasty viruses!   

[Broni]

That's not all.
You need to post all three logs for us to see, IF your computer is clean.

[zoe]

Here are the 3 logs that you requested.  I deleted the trojan virus from the malware scan which fixed my pop-up message problem.  Thanks again for all your help.   

[recovering space - attachment deleted by admin]

[evilfantasy]

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-AA8C-E56FA49CA83A} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Download SDFix.exe and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally add the contents of the Report.txt in your next post along with a fresh Hijackthis log.

[zoe]

OK!  Please see attached files.

[recovering space - attachment deleted by admin]

[evilfantasy]

That got on eof them, the next one will need a more powerful tool.

Please download Combofix by sUBs from one of the below links.
(Try all three if necessary)

• Link #1
  
• Link #2
  
• Link #3

Important! Combofix.exe MUST be saved to and ran from the Desktop.

• Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
• Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
  • Click this link to see a list of security programs that should be disabled and how to disable them.
    
  • If yours is not listed and you don't know how to disable it, please ask.
• Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
  
• Double click combofix.exe & follow the prompts.
• Choose Yes to accept the Disclaimers.[

• When finished, it will produce a log for you.
• Post that log in your next reply.

Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall

• If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
  
• Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.

.
Please add the combofix log in the next reply.

[zoe]

See attached.  Thanks!

[recovering space - attachment deleted by admin]

[evilfantasy]

Looks good. We need to scan a file, hopefully it will come back clean.

Scan Suspicious File(s)

Please visit Virustotal
(If more than one file needs scanned they must be done separately and logs posted for each one)

• Copy the file path in the below Code box:

Code: [Select]

C:\WINDOWS\C:\WINDOWS\System32\svchost.exe

• At the upload site, click once inside the window next to Browse.
  
• Press Ctrl+V on the keyboard (both at the same time) to paste the file path in the window.
  
• Next click Send File
  • Your file will possibly be entered into a queue which normally takes less than a minute to clear.
• This will perform a scan across multiple different virus scanning engines.
• Important: Wait for all of the scanning engines to complete.
  
• Copy and then Paste the link to the results in the next reply.

[zoe]

I visited the Virustotal site as instructed.  After copying the Code in box (C:\Windows\C:\Windows\System32\schost.exe)  and sending the file, I get this message:  0 bytes size received / Se ha recibido un archivo vacio

Did I do something wrong?  Thanks for your patience.

[evilfantasy]

You didn't do anything wrong, it won't scan 0 byte files.

Go to Start > Run and copy then paste this line into the box and hit enter:

sc stop wscsvc

Now again Start > Run and paste this line and hit enter:

sc delete wscsvc

How is everything now?

[zoe]

Did it!  My computer is running great with no more annoying pop-ups.  Thank you so very, very much for your help.  People like you make the world a much better place!  May God Bless you!

[evilfantasy]

Still a few more fianl steps.

Let's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done.
.

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

.

.
The above procedure will:

• Delete:
• ComboFix and its associated files and folders.
• VundoFix backups, if present
• The C:\Deckard folder, if present
• The C:_OtMoveIt folder, if present

• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

.
Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
Here are some great tools to help you keep from getting infected again.

To prevent unknown applications from being installed on your computer install WinPatrol 2007

Another thing I would suggest installing SiteAdvisor. SiteAdvisor rates sites on business practices and spam.

Spybot Search & Destroy - A safe and effective spyware scanner.
* Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

AVG Anti-Spyware Free Edition - Very reliable with a high detection rate.
* AVG Anti-Spyware User Manual

SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware

Comodo BOClean - Stops trojans and many more malicious attacks.

Use a Firewall - It can not be stressed enough how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over.
* Click here for a list of free firewalls.
* Why would I consider a third party firewall?
* Understanding and Using Firewalls

 UPDATE!!! UPDATE!!! UPDATE!!! - If you do not have automatic updates enabled then visit http://www.windowsupdate.com[/b]]http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer.
* Help with Windows updates

Learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?

Let us know if anything else comes up.