removal of virusscanner. it sounds weird, but help wanted anyway

[Emiel]

Hi guys,

my dad accidentaly installed Virus Response Lab 2009. He uninstalled the whole thing but can't delete it's icon in the right-bottom part of the screen. Because of what's left of the program, we get pop-ups when booting that we don't want to. Also, they appear when we're doing stuff on the computer. Does anyone know how to remove this?

Thanks.

[flomtl]

Hey im not an expert or anything, so you may want to wait for expert advice, however, you could try to download CCleaner. Run Cleaner and also scan for issues. It gets rid of left over files from delete programs.

Hope that helped..

Florian

[evilfantasy]

Virus Response Lab 2009 is a rouge antivirus and it can not be removed by normal means. It's malware so you need to start here http://www.computerhope.com/forum/index.php/topic,46313.0.html

Post the 3 logs here when complete.

[Emiel]

I can't do this yet 'cause i'm at school. But i'll get to it as soon as i'll get home.

[evilfantasy]

No problem. This thread will be waiting...

[Emiel]

I printed the guide for removing malware, just so i can read it when i don't have access to the page.

Thanks for your help so far evilfantasy.

[Emiel]

Ok, i checked the add/remove program list and there are no suspicous programs. I also checked if we had an antivirus program, and we do. Etrust Antivirus.

[Emiel]

One more thing. Can i do other stuff while the programs are busy scanning?

[Carbon Dudeoxide]

One more thing. Can i do other stuff while the programs are busy scanning?

I wouldn't recommend it.

[Emiel]

Ok, thanks for replying Carbon. Evilfantasy, here's the first log, the Superantispyware log.

[Saving space - attachment deleted by admin]

[Emiel]

And the second one, the malwarebytes log.

[Saving space - attachment deleted by admin]

[Emiel]

And the last log, hijackthis log.

[Saving space - attachment deleted by admin]

[Emiel]

I followed the guide as evilfantasy told me to. The icon and a lot of viruses are gone now, but can you confirm this? Thanks.

[evilfantasy]

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

Also let me know how everything is now.

[Emiel]

Thanks for replying evilfantasy, the pc is running smoothly. Here's the combofix log. I forgot to disable the antivirus program btw... 

[Saving space - attachment deleted by admin]

[evilfantasy]

It looks good now.

Let me know if you have any questions.


• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.
• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.
.
----------

Disable the System Restore Utility to prevent re-infection from an old one

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Put a check mark next to Turn off System Restore on All Drives
4) Click the OK button.
5) You will be prompted to restart the computer. Click the Yes button.

Now re-enable System Restore

To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Remove the check mark next to Turn off System Restore on All Drives
4) Click the OK button.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.