Quick Question----

[whosjohnny]

My bosses computer is fuckeedddddd. He got one of those Trojan Worms from the bullshit Security 2012 Anti Virus shit.....Ive done everything possible to get rid of the shit and I told him Im done trying to figure the shit out.....time for you to get a new comp anyway. The thing is...we still run on a shitty ass Microsoft 2000 server. Will a Windows 7 comp be alright to connect back to our server??

[antknee]

i have a similar virus that keeps coming back (Fraud Security 2011). Have you tried googling the exact virus, and deleting all the folders pertaining to the virus? If you run an anti-virus software too, try running it in safe mode

[whosjohnny]

Yeah...Ive tried everything possible. I even edited the registry in safe mode.....changed the boot.ini to stop the thing from starting up...and at one point the bs Security Window opened up in Safe Mode...I was like Whoaaaa WTF thats not suppose to happen lol. I Malwarebyte it over and over and it keeps detecting and cleaning...but it keeps coming back. He's had all his printers disappear and programs too. I had to Unhide all that and run even more scans lol. It keeps coming back. I know you can downgrade a comp to run XP....but not sure if maybe Best Buy had comps in the store with them.

[djcyph]

i have a similar virus that keeps coming back (Fraud Security 2011). Have you tried googling the exact virus, and deleting all the folders pertaining to the virus? If you run an anti-virus software too, try running it in safe mode

this...when i used to use pcs with crazy viruses id do that....the anti virius should take care of all or most infected files..if it doesnt and u know exactly what day and good time frame that he got the virius u can look in your system folders and startup folders and delete files that were created that day/time frame...i would google the name of the files first so you dont delete vital system files

i think win 7 may be compatible with the 2000 server but probably be a pain in the ass to set up as there is no support for 2000 server anymore

[whosjohnny]

Yes....Ive even ran the scans in safe mode....it finds shit....cleans up...and upon boot after a while....its back. Ive been at it for over 2 weeks now with his comp....I told him I give up. He's even had the company that handles our tech support via VPN try shit and they gave up after a day. So I told him....your shit is done....that hard drive needs to be bashed with a bat or something and you need a new comp.

[StateOfTrance]

2 weeks? Re-image the shit already, jesus haha. That XP 2012 virus is all over the place. I've already removed it from one persons computer, and did it remotely. I have 2 more in progress right now. One laptop had to be shipped back to me cuz she had no internet at all and the other im about to look into. Your shit must be on steroids cuz Malwarebytes should be able to remove it, that is if you can get it to run/install/update. This infection typically blocks all or some of those functions. If you have an updated version of malwarebytes running and it still does not work that shit is on steroids. Should have re-formatted a long time ago and saved the time and energy spent.

[tonei.]

First go into my computer, then go to the tools folder on the top, go into folder options, click the view tab, click the bullet point that says "show hidden files and folders", and click the box that says "protected operating system files", make sure its NOT checked..


Then run it in this order....


System restore to a date prior to when you got the virus.... Its worth a shot, but most times the virus corrupts all your restore points... if there not, then that should take care of it. But if that doesn't work


IN THIS ORDER

-ccleaner...
http://www.piriform.com/ccleaner
make sure you close all of your browser when this is running, run it to get rid of all temp files... then go to the registry cleaner and run that, its going to scan first, then you make a backup of your registry when it asks, then select "fix all problems.."

-then
tdskiller
http://support.kaspersky.com/faq/?qid=208280684
run it..


-then try malware one more time...


-Then go to the run prompt in the start menu and type
sfc /scanonce (make sure there is a space after sfc)

its going to repair any of you critical windows files that have been compromised....


then go to Combofix
http://www.bleepingcomputer.com/down...virus/combofix

This is the main mofo, if you cant fix it with this after running all the other steps first then it hopeless...

MAKE SURE you shut off ALLLL of your virus protection while you are running combofix or it will give false positives and fuck your shit up...



I have taken out back doors with this that didnt show up on any of my scans... This came from the mods at Malwayware bytes...



If everything is good and working go to system restore and turn off then back on to erase all of the restore point that are stored on the computer with the virus on it...


Then go to windows update and update your system

[Lance Burkhart]

+1 mac

[tonei.]

First go into my computer, then go to the tools folder on the top, go into folder options, click the view tab, click the bullet point that says "show hidden files and folders", and click the box that says "protected operating system files", make sure its NOT checked..


Then run it in this order....


System restore to a date prior to when you got the virus.... Its worth a shot, but most times the virus corrupts all your restore points... if there not, then that should take care of it. But if that doesn't work


IN THIS ORDER

-ccleaner...
http://www.piriform.com/ccleaner
make sure you close all of your browser when this is running, run it to get rid of all temp files... then go to the registry cleaner and run that, its going to scan first, then you make a backup of your registry when it asks, then select "fix all problems.."

-then
tdskiller
http://support.kaspersky.com/faq/?qid=208280684
run it..


-then try malware one more time...


-Then go to the run prompt in the start menu and type
sfc /scanonce (make sure there is a space after sfc)

its going to repair any of you critical windows files that have been compromised....


then go to Combofix
http://www.bleepingcomputer.com/down...virus/combofix

This is the main mofo, if you cant fix it with this after running all the other steps first then it hopeless...

MAKE SURE you shut off ALLLL of your virus protection while you are running combofix or it will give false positives and fuck your shit up...



I have taken out back doors with this that didnt show up on any of my scans... This came from the mods at Malwayware bytes...



If everything is good and working go to system restore and turn off then back on to erase all of the restore point that are stored on the computer with the virus on it...


Then go to windows update and update your system

this is instructions for tdskiller i got off mbytes site


1. Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.




2.Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.





3. Click the Start Scan button.





4. If a suspicious object is detected, the default action will be Skip, click on Continue.




5. If malicious objects are found, they will show in the Scan results and offer three (3) options.
6. Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.



7. Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

[whosjohnny]

Thanks Bros for the replies. Tonei, I had tried all those too already. In the end...since it wasnt my own comp at work (I work on 2 Imacs) and they dont pay me to be an IT person I told them it was time to get another comp anyway.

[tonei.]

If you couldn't dent it with all that shit, then it was time

[djcyph]

after he gets new one ask for old one if its decent enough then reformat and keep it