Buddy has a virus, need help!

[Pigslilspaz]

A buddy of mine's laptop (Dell Latitude D505) has caught one of those virusblocker virus's (the ones pretending to be a blocker and ask you to pay them money). It's called Antivirus.net. How would I go about removing this program?

[outbreak]

First thing is first, Did he click install, If he did well I would backup his files he wants to keep on a disc and then reformat that thing.

If not try this:

Step 1 : Use Windows Task Manager to Remove Antivirus .NET Processes

Remove the "Antivirus .NET" processes files:

%AppData%\[random]\[random]affm.exe
[random].exe

Step 2 : Use Registry Editor to Remove Antivirus .NET Registry Values

Locate and delete "Antivirus .NET" registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:33921"
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = "0"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus .NET
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Antivirus .NET"
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKCU\Software\Antivirus .NET

Step 3 : Detect and Delete Other Antivirus .NET Files

Remove the "Antivirus .NET" processes files:

%CommonDesktop%\Antivirus .NET.lnk
%CommonPrograms%\Antivirus .NET
%AppData%\[random]\[random]affm.exe


If using Windows 7 and you dont know how to access RUN well its simple, In the search field to open RegEdit type: regedit.exe and it will find it for you.

To open Task Manager hit: Ctrl + Shift + Esc.

Any questions let me know!

[Pigslilspaz]

its XP and he did not install anything, it attacked on its own

[TequilaChaser]

will not SpyBot work , along with ESET's free online virus scanner?

both are free....

as long as it did not install it, these both should pick it up as malware and get rid of it... I would think...., they will ask to reboot PC or tell you it needs to reboot/restart.
this is to flush the memory......

[Tec]

Just had it the other day.  If it's the same one I had whenever you try to click on your malware, antivirus, or any other program for that matter it blocks it and says that "it's infected".  The way around this is quite simple.  When he first boots his computer there is a window of time there where he can get his programs open before the virus loads.  The most effective way to deal with it I found was to hit ctrl+alt+del as soon as i got into windows to get my task manager open before I got locked out, then just look for processes to pop up that shouldn't be there and do an "end process tree".  He should now be able to update and run his malware and antivirus and get it cleaned out.

[gpwurzel]

Download malwarebytes - save it to a pendrive, disk or whatever. Boot machine into safe mode with networking, install mb and update/run. Once thats done, also go to run, type in msconfig and ensure its not part of the startup tab.

hth,

Wurzel

[Pigslilspaz]

Download malwarebytes - save it to a pendrive, disk or whatever. Boot machine into safe mode with networking, install mb and update/run. Once thats done, also go to run, type in msconfig and ensure its not part of the startup tab.

hth,

Wurzel

will do, looked something else up and this is what it said as well. Their comp doesn't really have any blocker system since it was given to him by school. I'm just glad i noticed it before he was stupid and put in his bank info.

[L0nGb0w]

if you can get task manager or command prompt open before the virus starts up you're golden.  it will be a series of random letters and numbers in the process list, just kill it, and find where the file resides.  then you have to remove it and any corresponding registry entries.  I had this virus as well and it was loading either through my .pdf reader or my java.  I updated both of them after deleting it and haven't seen it since.

[redman555]

Its a hijacker.

-BigBOBCH

[Tyrannis]

A buddy of mine's laptop (Dell Latitude D505) has caught one of those virusblocker virus's (the ones pretending to be a blocker and ask you to pay them money). It's called Antivirus.net. How would I go about removing this program?

i had something just like this wreck my old computer!


it downloaded itself onto my computer somehow, then pretty much destroyed the virus protection i did have.


then it started marking every website i tried to go to as "harmful!" so i couldnt use the internet.

i tried calling them about it but it was a fake british phonenumber.

i ended up just getting a new computer

[Yeager]

people who write and deploy these programs should be euthanized 

[Reschke]

people who write and deploy these programs should be euthanized 

When found they need to be drawn and quartered and put on display online and in public. With the next statement that should this continue then their families will follow for lacking the testicular fortitude to TEACH THEM TO BE RESPONSIBLE PEOPLE!

[Shuffler]

Here are removal instruction.... http://www.spywareremove.com/removeAntivirusNET.html   

Removing it manually usually disables the problem program. Then install a good Av and it will clean up any fragments. Microsoft Security Essentials does a good job on Windows 7 machines. It will stop it from happening again.

[Pigslilspaz]

What would work for XP? this is a college owned computer, at least it isnt vista

[5anders]

I just fixed a co-workers netbook that had the same virus by using malwarebytes.  It worked like a charm.