Help to remove virus

  ronec 10:42 13 Nov 2011

I am just checking my grand daughters Dell laptop. Unfortunately she is not here at the moment to advise me what happens to the computer, but I understand it keeps crashing. I have started it in Safe Mode nd am running an AVG command line scan. It has found a couple of Trojan Horses and the same virus name keeps cropping up- Win32/Natusha.A Sometimes AVG moves the infected file to the Virus Vault and some it does not appear to do anything with. There are a number of different Trojan Horses,ie 'Backdoor,Generic14AVBQ',this has not been moved, but Generic25.AAAS and Dropper.Generic.BLPX have both been moved. Some files are stating 'Locked File. Not tested' Is this normal, for them not to be checked. Any help much appreciated.

  birdface 10:47 13 Nov 2011

Download and run this.

  ronec 10:54 13 Nov 2011

Hi Buteman. Thanks for your reply. I am a bit slow with computers. Can I actually use the Internet whilst in Safe Mode?

  birdface 11:35 13 Nov 2011

Yes use safe mode with internet connection.

  rdave13 11:38 13 Nov 2011

You should be able to select safe mode with networking. Don't think it will allow you to install in safe mode. Can you download SAS portable on another PC and copy to a CD or USB flash drive then run it on the infected PC in safe mode. Then run Malwarebytes in normal mode. SAS portable

  birdface 11:38 13 Nov 2011

I should have said Safe mode gives you the choice of two.Safe mode.or safe mode with internet conectiom.

  ronec 11:50 13 Nov 2011

I have managed to download Malwarebytes. Unfortunately the Program stops running a couple of seconds after it starts. If I reload it, a windows error pops up saying 'Windows cannot load the device. You may not have the correct Permissions' Malwarebytes Help section says that some virus's stop the program running and that if that happens I should rename the set up file. As I downloaded it to the desktop, I presumed that to be the set up file. I renamed the icon but still get the same error. Am I looking in the wrong place for the set up file. I also tried renaming files inside the Malwarebytes file in Programs, but it will not let me.

  Fruit Bat /\0/\ 12:10 13 Nov 2011

In malwarebytes folder rename mbam.exe to startme.exe then double click to run it.

Some files are "locked" things like restore folder are locked and viruses can hide in there.

  ronec 12:21 13 Nov 2011

Hi Fruit Bat. I have looked in the folder and there does not appear to be a mbam.exe. There are quite a few mbam files but non being an .exe file. Obviously one of them is because the program will install. I renamed one that was an application file, but it would not let me. There is another file that has the mbam logo on it. I renamed that one and double clicked but nothing happened. In your statement about the locked files, do you mean that the virus could have locked them and be hiding in there or are they locked so that by windows so they can't hide in there.

  Nontek 12:34 13 Nov 2011

Download and run rkill, then try MalwareBytes again.

  birdface 12:53 13 Nov 2011

Or this one which works very quick.This will do a scan in about 10 minutes but you have to activate the account for it to remove anything.So wait and see what it finds.

Once account is activated it will only last for 30 day trial after that it will still work but not remove anything.

best downloaded in safe mode.

If using I/E go to tools.internet options.connections.lan settings and if use a proxy server is ticked untick it then you should be able to update and run Malwarebytes.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

OnePlus 5T review: Hands-on

Illustrator Andrés Lozano on his improv line work, brazen use of colours & hand sketching

iPhone X review

Comment envoyer gratuitement des gros fichiers ?