# Do I have some kind of Malware?

**URL:** <https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755>\
**Category:** Factual Questions\
**Created:** [August 26, 2009, 10:40am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755 "2009-08-26T10:40:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![longPath](https://avatars.discourse-cdn.com/v4/letter/l/bb73d2/32.png) [@longPath](https://boards.straightdope.com/u/longPath)\
**Post date:** [August 26, 2009, 10:40am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/1 "2009-08-26T10:40:25Z")

</div>

While I’m browsing, this image pops up randomly:

[![](https://tinypic.com/images/goodbye.jpg) ](https://tinypic.com/images/goodbye.jpg)

It looks bogus to me but PC Tools Spyware Doctor fails to identify a threat.

I’m also getting random re-directs from Google search results.

Thanks

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 26, 2009, 11:39am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/2 "2009-08-26T11:39:13Z")

</div>

Yes, you are infected.

---

<div class="post-metadata">

**Author:** ![Yssy](https://avatars.discourse-cdn.com/v4/letter/y/bbce88/32.png) [@Yssy](https://boards.straightdope.com/u/Yssy)\
**Post date:** [August 26, 2009, 12:14pm UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/3 "2009-08-26T12:14:56Z")

</div>

Malware bytes will take care of it quickly and easily and it’s free!

---

<div class="post-metadata">

**Author:** ![ianjohnson](https://avatars.discourse-cdn.com/v4/letter/i/a3d4f5/32.png) [@ianjohnson](https://boards.straightdope.com/u/ianjohnson)\
**Post date:** [August 26, 2009, 3:51pm UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/4 "2009-08-26T15:51:30Z")

</div>

The giveaway is that you are running XP and that is a Vista-style window.

Ad-aware by Lavasoft is a good one, and it is free. The free version needs you to initiate a scan, and the paid version will scan automatically.

---

<div class="post-metadata">

**Author:** ![VinylTurnip](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@VinylTurnip](https://boards.straightdope.com/u/VinylTurnip)\
**Post date:** [August 26, 2009, 4:21pm UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/5 "2009-08-26T16:21:49Z")

</div>

> [@ianjohnson](#):
>
> The giveaway is that you are running XP and that is a Vista-style window.

Well, that and the stilted English. (“Poorly translated” stilted, and not just “written by programmers” stilted.)

---

<div class="post-metadata">

**Author:** ![PapSett](https://avatars.discourse-cdn.com/v4/letter/p/ecc23a/32.png) [@PapSett](https://boards.straightdope.com/u/PapSett)\
**Post date:** [August 26, 2009, 5:19pm UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/6 "2009-08-26T17:19:39Z")

</div>

Yes. It looks very similar to one I was infected with earlier in the year that called itself ‘Personal Antivirus’. It kept trying to scam me out of $60 to ‘activate’ it, and when I wouldn’t, it effectively locked my computer up and wouldn’t llow me to access any websites other than my e mail. I tried using the free virus/malware services and it did no good. I had to take the computer into the shop to get it removed.

Good luck!

---

<div class="post-metadata">

**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\
**Post date:** [August 26, 2009, 7:06pm UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/7 "2009-08-26T19:06:15Z")

</div>

When you download programs like Malwarebytes’ Anti-Malware (free version) and they can’t get rid of it, try running the program from safe mode. Some malware will stop anti-malware from doing it’s job. Usually running it from safe mode will help.

---

<div class="post-metadata">

**Author:** ![longPath](https://avatars.discourse-cdn.com/v4/letter/l/bb73d2/32.png) [@longPath](https://boards.straightdope.com/u/longPath)\
**Post date:** [August 27, 2009, 1:29am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/8 "2009-08-27T01:29:51Z")

</div>

Thanks for all your suggestions.  
I spent the last 6 hours battling this thing but I think I beat it.  
It took a few tries but Malware Bytes finally detected an infection it called: “ESQULzcounter, Trojan Dropper”. It insisted that it was removing the inection on reboot but in fact, It never did.  
Further research led me to a tool called SysProt which detected a rootkit infection. The final blow was dealt by “ComboFix”.

I hope I never have to go through that grief again. :smack:

---

<div class="post-metadata">

**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\
**Post date:** [August 27, 2009, 2:03am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/9 "2009-08-27T02:03:49Z")

</div>

Creating a limited user account works very well for me and my users.

---

<div class="post-metadata">

**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\
**Post date:** [August 27, 2009, 8:17am UTC](https://boards.straightdope.com/t/do-i-have-some-kind-of-malware/507755/10 "2009-08-27T08:17:54Z")

</div>

> [@Markxxx](#):
>
> When you download programs like Malwarebytes’ Anti-Malware (free version) and they can’t get rid of it, try running the program from safe mode. Some malware will stop anti-malware from doing it’s job. Usually running it from safe mode will help.

[computer shop owner hat on]

The big hammer around here is mounting the drive via usb adapter to a machine with several virus tools up and running on it. We have a machine that we can reimage back to fresh load with all AV apps in place in like 10 min just as an AV tool. The AV apps operating from a clean OS will splatterkill most of the nasties on an infected drive in short order. We usually hit it with

AVG  
Malwarebytes  
Spybot s&d  
superantispyware  
kaspersky

we also have virtualized copies of several AV apps that can just be run from a flash drive.

if that doesent kill it, we try a repair install of windows, this sometimes cracks the defenses of a few nasties and allows a cleaner kill.
