# Experience with Win 7 security \[something\] 2012 **URL:** \ **Category:** Factual Questions\ **Created:** [December 29, 2011, 5:16pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734 "2011-12-29T17:16:09Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [January 3, 2012, 7:56pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/21 "2012-01-03T19:56:36Z")
What a coincidence. I got hit with the same malware while visiting this site on 23 Dec. What a shocker! I think I’m up to 4 times being hit with malware from the SD. > [@Washoe](#): > > I got hit with this bitch on Christmas Eve. I wound up shelling out $30 for Spyware Doctor, which cleaned it up quite nicely. Things were still a little wonky afterwards, though, so I had to rollback the machine to the most previous restore point. Wish I had tried MalwareBytes first. MalwareBytes did the trick for me but the EXE thing was a bitch and everything had to be run as an administrator so I rolled mine back too. ---
**Author:** ![Baron\_Greenback](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/baron_greenback/32/48_2.png) [@Baron\_Greenback](https://boards.straightdope.com/u/Baron_Greenback)\ **Post date:** [January 3, 2012, 8:25pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/22 "2012-01-03T20:25:28Z")
> [@Saint\_Cad](#): > > MalwareBytes did the trick for me but the EXE thing was a bitch and everything had to be run as an administrator so I rolled mine back too. If you get it again, with the added EXE twist, try renaming the malwarebytes executable from mbam.exe to mbam.scr and then double-clicking it. Worked for me when I had this problem. ---
**Author:** ![Hari\_Seldon](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hari_seldon/32/5173_2.png) [@Hari\_Seldon](https://boards.straightdope.com/u/Hari_Seldon)\ **Post date:** [January 4, 2012, 1:59am UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/23 "2012-01-04T01:59:17Z")
> [@Maserschmidt](#): > > I got this malware last week and attempted to clean up my own registry, which was probably not the brightest idea. I ended up having to re-image the PC, which wasn’t a huge problem since it was a recent purchase. > > I’d like to punch in the face whoever writes these things. That’s much too mild. I am generally opposed to capital punishment, but I would make an exception for virus writers. I caught this one just a week ago. I happened to be visiting my daughter and SIL over the holidays. My SIL googled the name of the virus and found instructions. I don’t recall exactly what they were, but I do know it involved downloading something on his computer, copying it to a USB memory stick and then booting in safe mode and running whatever was on the stick. It worked! He ran two different programs and I think Malwarebytes was one of the them. ---
**Author:** ![thebenn](https://avatars.discourse-cdn.com/v4/letter/t/dfb087/32.png) [@thebenn](https://boards.straightdope.com/u/thebenn)\ **Post date:** [January 4, 2012, 2:25pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/24 "2012-01-04T14:25:25Z")
I got this malware a couple of weeks ago. I just went back to a restore point from a couple of days prior to the infection. That seemed to clear it right up. Easy-peasy. ---
**Author:** ![toofs](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@toofs](https://boards.straightdope.com/u/toofs)\ **Post date:** [January 5, 2012, 3:58am UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/25 "2012-01-05T03:58:21Z")
I got this very same malware while surfing the SDMB last month. Twice. It seriously fucked up my computer. Windows firewall was disabled, and even doing registry imports could not fix it. I ended up reinstalling Vista and spending a week doing updates and scans. Now I only use Firefox with FlashBlock, AdBlock, and NoScript add-ons. Acrobat Reader is not on my system, only Foxit Reader. Go to [bleepingcomputer](http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012) to remove. In my case, it was all “removed” and Malwarebytes, SuperAntispyware, and Microsoft Security Essentials all said my system was clean. I went back on the web and within a few clicks my browser was redirected and my system was reinfected. Good luck, everyone. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [January 5, 2012, 6:53pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/26 "2012-01-05T18:53:33Z")
> [@toofs](#): > > In my case, it was all “removed” and Malwarebytes, SuperAntispyware, and Microsoft Security Essentials all said my system was clean. I went back on the web and within a few clicks my browser was redirected and my system was reinfected. That is because you probably had the TDSS/TLD4/Alureon rootkit, which is capable of hiding files so securely no antivirus/antimalware can detect them. ---
**Author:** ![griffin1977](https://avatars.discourse-cdn.com/v4/letter/g/977dab/32.png) [@griffin1977](https://boards.straightdope.com/u/griffin1977)\ **Post date:** [January 5, 2012, 9:47pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/27 "2012-01-05T21:47:46Z")
> [@toofs](#): > > Go to [bleepingcomputer](http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012) to remove. In my case, it was all “removed” and Malwarebytes, SuperAntispyware, and Microsoft Security Essentials all said my system was clean. I went back on the web and within a few clicks my browser was redirected and my system was reinfected. I was in exactly the same state. Combofix ([http://www.combofix.org/](http://www.combofix.org/)) did the trick though ---
**Author:** ![Hennessy](https://avatars.discourse-cdn.com/v4/letter/h/a9a28c/32.png) [@Hennessy](https://boards.straightdope.com/u/Hennessy)\ **Post date:** [January 5, 2012, 10:00pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/28 "2012-01-05T22:00:36Z")
I just gonna copy & paste a post I made from a different forum. When it is real bad, I take the time and have professionals at another forum help me. I can’t not post the link so hopefully I can just tell you how to get there. Copy & search “everyone read before posting malware” into Google and click the first one. _Edit_ Turns out you can post links at the StraightDope [http://forums.techguy.org/virus-other-malware-removal/943214-everyone-must-read-before-posting.html](http://forums.techguy.org/virus-other-malware-removal/943214-everyone-must-read-before-posting.html) You would have to register and follow the directions thoroughly. Using a forum you can’t expect them to respond immediately and may be some hours or more before they can go over it and they will have to give you further directions with some issues. They know what they are doing and it is free. I’ve used them once and it works, also sometimes just because the issues seem to be resolved, your computer could still be infected or hijacked. Good luck It may be similar to [bleepingcomputer.com](http://bleepingcomputer.com) ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 5, 2012, 10:58pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/29 "2012-01-05T22:58:54Z")
For those using Windows 7 who might be worried about using a restore point because you don’t want to lose work, note that it doesn’t wipe out changes you made to documents since the last restore. It wipes out only application installations. So if you haven’t installed any new applications since the last restore, it’s the easy way to get rid of the virus. I was hit by this same malware twice (yes, on the SD both times). The first time I used Bleepingcomputer, rkill, and all that stuff. It worked fine but took some time. The second time I used a restore point and it was completely recovered in 10 minutes. Take the easy path if you can. ---
**Author:** ![LurkerInNJ](https://avatars.discourse-cdn.com/v4/letter/l/ed655f/32.png) [@LurkerInNJ](https://boards.straightdope.com/u/LurkerInNJ)\ **Post date:** [January 6, 2012, 11:13pm UTC](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734/30 "2012-01-06T23:13:09Z")
> [@Saint\_Cad](#): > > What a coincidence. > I got hit with the same malware while visiting this site on 23 Dec. What a shocker! > I think I’m up to 4 times being hit with malware from the SD. I got it from this site earlier today. [Previous page](https://boards.straightdope.com/t/experience-with-win-7-security-something-2012/607734.md?page=1)