WinPC Antivirus bastard

[Visitor Q]

Right, the bastard has just appeared, joy.

Any recommended routes of killing?

Found this(spydoctor), but may be out of pan in to fire if I don't check legitimacy.

So, little help?
____________________
China traffic/travel bike vid - When I make a sweeping statement, please add the word 'statistically' in to the sentence before you bitch...
From September 2014 to January/February 2015 I will not be using any English, nor reading any. As such, I won't be on here. PM at will, but I won't be checking/posting unless in emergencies. Certainly not for the first couple of months. Please berate me savagely if I break that rule...

[steve32]

ive just had a look around the net about it and ive found this website that should get rid of it https://www.bleepingcomputer.com/virus-removal/remove-winpc-antivirus
____________________
suzuki GSX 600F katana .: ~my bike up for sale~ :.
CBT = Completed
DAS= Working on it - theory test = Passed

[Mal]

This appeared on one of the laptops over the weekend, the trial versions of spy doctor and malwarebytes anti-malware both found it but needed the full version in order to clean it off the pc. The missus is saying that it's still not right so looks like I'll be rebuilding it at some point.

Mal
____________________
Current: 2002 FJR1300, 1999 Thundercat, Previous: 1998 XVS650 Dragstar

"In the end we're all just chalk lines on the concrete - drawn, only to be washed away."

[Visitor Q]

Thanks for the link steve, it does seem slightly more legit (I don't really trust any of these sites but meh).

Whats irritating is you have to be dumb enough to install it in the first place. Which I 100% did not. I was watching some vids on line (not porn) on a safe bridging site and suddenly poof... your subscriptions are out of date.
____________________
China traffic/travel bike vid - When I make a sweeping statement, please add the word 'statistically' in to the sentence before you bitch...
From September 2014 to January/February 2015 I will not be using any English, nor reading any. As such, I won't be on here. PM at will, but I won't be checking/posting unless in emergencies. Certainly not for the first couple of months. Please berate me savagely if I break that rule...

[Whosthedaddy]

I had this appear and soon after my laptop started going nuts with trojan alerts. Took a bit to remove it after some googling.
____________________
Current : MSX 125 Past : CBR 900RR Monkeybike : c50 LAC : ZXR750 H2 : FZR600 : ZX7R P3 : YW100 : TRX850: Trophy 900 T309 : GSXR 600 L0: Monkeybike : XJ6S Whosthedaddy

[NSR Mick]

The free version of Malwarebytes has removed this for me on several occasions.
____________________
If you dont like the way that I ride.......Stop trying to keep up!!!

[Visitor Q]

[Visitor Q]

[steve32]

im pleased it served its purpose

i installed it on mine to make sure it was ok before i posted the link
____________________
suzuki GSX 600F katana .: ~my bike up for sale~ :.
CBT = Completed
DAS= Working on it - theory test = Passed

[Visitor Q]

Fag on a stick.

Eventually got the malbyte thingy installed, then computer locked up and I had to leave.

Came back to turn it on, black screen and that was that. Eventually through various likely key combinations (looking for safe mode so F2, F5, Ctrl etc) it randomly started working after some loud beeping.

Now though, clicking the malbyte scan thing to initiate the scan gets the 'busy' hour glass for a few seconds, and then it goes back to the pointer like nothing has happened.



I gave up before I went nuts, but what do you reckon I should try now?

All this by the way on the computer loaded to the hilt with expensive anti-virus software My one is pure as the driven snow and survived all kinds of spurious downloads over uni with nothing but a slight spyware scrub now and then.

Antivirus software, more trouble then its worth (I would bet good money its the antivirus software blocking my attempts at removing the virus it let through )
____________________
China traffic/travel bike vid - When I make a sweeping statement, please add the word 'statistically' in to the sentence before you bitch...
From September 2014 to January/February 2015 I will not be using any English, nor reading any. As such, I won't be on here. PM at will, but I won't be checking/posting unless in emergencies. Certainly not for the first couple of months. Please berate me savagely if I break that rule...

[Seb]

Rename the executable for Malwarebytes to something else then do a full scan again. It's pretty much par for the course for recent scareware programs to block the program name, if someone knows how they do it I'd be very interested in knowing how

[Visitor Q]

[Visitor Q]

Argh, bastard. Every now and then it refuses to load a page and instead tells you its not safe for you to go on teh internets.

Bastard.

Right, 2nd time.

That didn't work, just made it easier to find in processes. I now have about 5 copies of that exe in the processes, all using memory just not being displayed. Everything else loads fine, and the installer is being blocked in the same way so seems logical that its the virus.

Tried killing off the processes, and have found two. One that goes away (and stays away) gets rid of the pop ups. Result. Other one gets rid of the icon in the taskbar for about 30 seconds.

How about safe mode? How does one get on to that again? it's been a while. About the only idea I've got left.
____________________
China traffic/travel bike vid - When I make a sweeping statement, please add the word 'statistically' in to the sentence before you bitch...
From September 2014 to January/February 2015 I will not be using any English, nor reading any. As such, I won't be on here. PM at will, but I won't be checking/posting unless in emergencies. Certainly not for the first couple of months. Please berate me savagely if I break that rule...

[Mal]

I found a link which told you which registry entries to delete to stop the program working, then mwb installed straight from the web and ran ok, but as I said earlier it said I needed a registered version in order to remove said item. I'll have a look tonight and see if I can find the page again.

[Finglonga]

Malwarebytes will remove it, not had any PC's that it hasn't successfully done it, so no need to pay out anything for another scanner. BUT make sure system restore is turned OFF before you scan as it will just keep coming back if not.
____________________
Andy Sez....
F.Y.Y.F.F.

[Visitor Q]

[Finglonga]

Press F8 repeatedly at startup and you will get the option to boot into safe mode.
____________________
Andy Sez....
F.Y.Y.F.F.

[stevekingchef]

hi i found today i had this winpc virus too!!!after a call to my resident pc geek friend he said to use the malbytes program software it seems to have worked but i was so pissed off i deleted some microsoft files or software so who knows what i did!!!!!


he said thatit can often be piced up in forums through links to other websites!!!!!today i was looking at some funnies that were classed as spam on this site could be them????


stay safe peeps

[Visitor Q]

Tis gone now. Yeh, found out about the F8 thingy and got in.

Still being funny on boot up though...
____________________
China traffic/travel bike vid - When I make a sweeping statement, please add the word 'statistically' in to the sentence before you bitch...
From September 2014 to January/February 2015 I will not be using any English, nor reading any. As such, I won't be on here. PM at will, but I won't be checking/posting unless in emergencies. Certainly not for the first couple of months. Please berate me savagely if I break that rule...

[Finglonga]