# Nasty virus/spyware problem. HELP!!!!!! **URL:** \ **Category:** Factual Questions\ **Created:** [October 6, 2011, 5:07am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758 "2011-10-06T05:07:37Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![pkbites](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pkbites/32/204_2.png) [@pkbites](https://boards.straightdope.com/u/pkbites)\ **Post date:** [October 6, 2011, 5:07am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/1 "2011-10-06T05:07:37Z")
My Spy Sweeper, which is usually excellent, tells me there is nothing wrong with my PC. :rolleyes: I’ve been attacked with something called AV Guard and my system is totally fucked. HELP! ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [October 6, 2011, 5:13am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/2 "2011-10-06T05:13:38Z")
I’m off to bed but Malwarebytes (from [malwarebytes.org](http://malwarebytes.org)) is usually pretty good. My usual routine for fucked computers is… download update run reset run reset to safemode run again reset run again lather rinse and repeat a few times of running in regular and safe mode until it comes up clean a few times in a row. Same thing for Ad-Aware and Spybot (if the computer isn’t ancient you can try and run two of them at the same time to speed things along but doing that along with a virus present has a bad habit of grinding things to a halt) ---
**Author:** ![pkbites](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pkbites/32/204_2.png) [@pkbites](https://boards.straightdope.com/u/pkbites)\ **Post date:** [October 6, 2011, 5:19am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/3 "2011-10-06T05:19:17Z")
How am I suppose to download that when I can’t get on the internet? It’s blocked. Right now I’m using my old lap top and hitching a ride on someones WIFI. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [October 6, 2011, 5:20am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/4 "2011-10-06T05:20:20Z")
> [@pkbites](#): > > How am I suppose to download that when I can’t get on the internet? It’s blocked. > > Right now I’m using my old lap top and hitching a ride on someones WIFI. Transfer it on a jumpdrive. Edit, download all three (malwarebytes, AVG and spybot) put them all on the jumpdrive, transfer it then toss it like you just stuck it in an old hooker. Run MWB and once you can get back on the internet, update it and run it again. Also if you can get into the Task Manager you might be able to kill whatever is keeping you off the internet. You might also be able to get to the internet from Safe Mode. ---
**Author:** ![pkbites](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pkbites/32/204_2.png) [@pkbites](https://boards.straightdope.com/u/pkbites)\ **Post date:** [October 6, 2011, 5:24am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/5 "2011-10-06T05:24:12Z")
It won’t let me open the task manager. Also, why did my spy sweeper miss this? It get’s updated constantly. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [October 6, 2011, 5:33am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/6 "2011-10-06T05:33:20Z")
It’s just not in your Spy Sweeper’s definitions yet. You’re probably going to want to reboot to Safe Mode and just start there. If it knocked out the internet and Task Manager, you’re already in pretty rough shape. Luckily, IME, viruses don’t seem to do as much damage as they used to do 15 years ago. Most of them seem to be more obnoxious then destructive. ---
**Author:** ![The\_Librarian](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/the_librarian/32/402_2.png) [@The\_Librarian](https://boards.straightdope.com/u/The_Librarian)\ **Post date:** [October 6, 2011, 6:31am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/7 "2011-10-06T06:31:09Z")
_cough_ [http://boards.straightdope.com/sdmb/showthread.php?t=538187](http://boards.straightdope.com/sdmb/showthread.php?t=538187) Do you have a backup? By the sound of it you’ll be better of with a clean install. ---
**Author:** ![Al\_Bundy](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Al\_Bundy](https://boards.straightdope.com/u/Al_Bundy)\ **Post date:** [October 6, 2011, 10:59am UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/8 "2011-10-06T10:59:34Z")
> [@pkbites](#): > > It won’t let me open the task manager. > > Also, why did my spy sweeper miss this? It get’s updated constantly. Try running MSCONFIG in safe mode and look at the “Start Menu.” Uncheck the virus process that is starting and note the name. Restart again in safe mode and go hunting for the location of the files. Eventually you can run “regedit” and clear it from the registry. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [October 6, 2011, 12:49pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/9 "2011-10-06T12:49:19Z")
> [@pkbites](#): > > I’ve been attacked with something called AV Guard and my system is totally fucked. AV Guard is brought to you by the same people that created the Security Guard spyware program. Here is a removal guide for Security Guard that should also work for AV Guard: > **[Remove Security Guard 2012 (Uninstall Guide)](https://www.bleepingcomputer.com/virus-removal/remove-security-guard-2012)** > > Security Guard 2012 is a computer infection from the Rogue.WinAVPro family, which includes other rogues such as OpenCloud Security. This infection is classified as a rogue anti-spyware program because it uses false security alerts and fake scan... ---
**Author:** ![engineer\_comp\_geek](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/engineer_comp_geek/32/504_2.png) [@engineer\_comp\_geek](https://boards.straightdope.com/u/engineer_comp_geek)\ **Post date:** [October 6, 2011, 1:07pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/10 "2011-10-06T13:07:04Z")
I’ve generally found over the years that when you get a computer this screwed up it’s fastest and easiest to just wipe the disk and re-install. You do have backups of important things, right? If not, I’d recommend booting a live linux cd (immune to windows nasties) and use that to copy important files off of your drive before wiping it. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [October 6, 2011, 1:11pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/11 "2011-10-06T13:11:48Z")
> [@engineer\_comp\_geek](#): > > I’ve generally found over the years that when you get a computer this screwed up it’s fastest and easiest to just wipe the disk and re-install. I would disagree if the computer is an older XP model, which has hundreds of updates to download and install. That by itself takes longer than cleaning the vast majority of spyware infections. ---
**Author:** ![lurcio](https://avatars.discourse-cdn.com/v4/letter/l/b77776/32.png) [@lurcio](https://boards.straightdope.com/u/lurcio)\ **Post date:** [October 6, 2011, 1:36pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/12 "2011-10-06T13:36:51Z")
A couple of tools that I have used with success in the past that might help are AVG Rescue CD > **[AVG Free Antivirus Download | Virus Protection Software](https://www.avg.com/en-ww/free-antivirus-download)** > > Download FREE AVG antivirus software. Get protection against viruses, malware and spyware. Easy-to-use virus scanner for PC, Mac & mobile. Download TODAY. Microsoft Standalone System Sweeper > **[Perfect, pastoral Palouse](https://www.bing.com?ref=aka&shorturl=connect-redirect)** > > The Palouse region in the Pacific Northwest is kno Both of these require you to download and burn to a CD on a clean system. Then boot from CD on the infected machine. They are both pretty good at connecting to the internet on a variety of hardware to get their updates once loaded. Good luck ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [October 6, 2011, 4:56pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/13 "2011-10-06T16:56:48Z")
> [@Fear\_Itself](#): > > I would disagree if the computer is an older XP model, which has hundreds of updates to download and install. That by itself takes longer than cleaning the vast majority of spyware infections. True, but, depending on how pervasive the infection is, it might be the safest / surest way to fix the problem. Hopefully not needed, however. For what it’s worth, our home PC had an infection this past summer that got past AVG _and_ Malwarebytes. Malwarebytes didn’t find anything. AVG would do its daily scan, say “quarantined these files!”, I’d delete the virus vault contents, rerun AVG and get “all clear”, and the next day there would be more viruses detected. Turned out to be a rootkit, a variant of a fairly nasty one. The damage was limited because it was my daughter’s account (which doesn’t have admin rights), but I wound up going to the Malwarebytes forum and getting help there. Took most of a week mainly because I had other stuff, like life, getting in the way of my computer time. ---
**Author:** ![Al\_Bundy](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Al\_Bundy](https://boards.straightdope.com/u/Al_Bundy)\ **Post date:** [October 6, 2011, 8:46pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/14 "2011-10-06T20:46:45Z")
> [@engineer\_comp\_geek](#): > > I’ve generally found over the years that when you get a computer this screwed up it’s fastest and easiest to just wipe the disk and re-install. You do have backups of important things, right? If not, I’d recommend booting a live linux cd (immune to windows nasties) and use that to copy important files off of your drive before wiping it. I prefer to fix the problem. So far I have been able to fix everything quickly. I have even downloaded a virus to test on. Fortunately, I have enough friends that get sick enough to keep me busy. The Security Guard/AV Guard is easily disposed of. No need to reload and start a bunch of stuff over again. If I ever did give up the fight, it takes me eight minutes to copy back a working clone disk and bypass all that work. I believe in a belt and suspenders rather than a noose. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [October 6, 2011, 9:02pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/15 "2011-10-06T21:02:37Z")
> [@Al\_Bundy](#): > > I prefer to fix the problem. So far I have been able to fix everything quickly. Do you run a limited or admin account when using the web? ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [October 6, 2011, 10:16pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/16 "2011-10-06T22:16:00Z")
I suggest **Microsoft System Sweeper** : [Search - Microsoft Bing](http://connect.microsoft.com/systemsweeper) > [@](#): > > You have been directed here to download and install the beta version of Microsoft Standalone System Sweeper Beta, a recovery tool that can help you start an infected PC and perform an offline scan to help identify and remove rootkits and other advanced malware. In addition, Microsoft Standalone System Sweeper Beta can be used if you cannot install or start an antivirus solution on your PC, or if the installed solution can’t detect or remove malware on your PC. You need to burn it onto CD and boot from that CD. ---
**Author:** ![pkbites](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pkbites/32/204_2.png) [@pkbites](https://boards.straightdope.com/u/pkbites)\ **Post date:** [October 7, 2011, 7:37pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/17 "2011-10-07T19:37:18Z")
Thanks for all the posts. Somehow I was able to get on line using a different search engine I had in my programs list, and update my Norton anti-virus and kill it. I don’t know why my Spy sweeper anti-virus/spyware software didn’t catch it. I tried updating that too but their page said mine was up to date. They need to get on the ball more I guess. My research says these things are coming out of Russia. Why? Why is some MOFO in Russia sending this crap out. And why don’t we occasionally hear about Russian storm troopers raiding some place these things are originating from and shooting everybody inside. It would sure make me feel better. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [October 7, 2011, 7:49pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/18 "2011-10-07T19:49:30Z")
> [@pkbites](#): > > My research says these things are coming out of Russia. Why? Why is some MOFO in Russia sending this crap out. Because some other mofo [made $100 million dollars](http://www.darkreading.com/insider-threat/167801100/security/antivirus/225200545/index.html)doing it, and now every Russian mother’s son want in. > [@](#): > > And why don’t we occasionally hear about Russian storm troopers raiding some place these things are originating from and shooting everybody inside. It would sure make me feel better. Because Russian stormtroopers like money, and it is good for the economy to have that much foreign cash rolling in. Besides, I also read that many of these programs check the native language setting of the target computer, and if it is Russian, it ignores the computer. They don’t foul their own nest. ---
**Author:** ![Cleophus](https://avatars.discourse-cdn.com/v4/letter/c/a88e57/32.png) [@Cleophus](https://boards.straightdope.com/u/Cleophus)\ **Post date:** [October 7, 2011, 7:54pm UTC](https://boards.straightdope.com/t/nasty-virus-spyware-problem-help/598758/19 "2011-10-07T19:54:35Z")
> [@pkbites](#): > > My research says these things are coming out of Russia. Why? Why is some MOFO in Russia sending this crap out. And why don’t we occasionally hear about Russian storm troopers raiding some place these things are originating from and shooting everybody inside. It would sure make me feel better. This [actually](http://krebsonsecurity.com/2011/08/fake-antivirus-industry-down-but-not-out/) [happened](http://www.bbc.co.uk/news/technology-13887152). The rate of fake AV infections plummeted over this summer as a result of a series of raids, including one on the Russian payment processor ChronoPay.