Member Avatar for csgaraglino

Ok, I hate to beat a dead horse, but it is back and stronger than ever!

I picked this stupid thing up at MegaVideos.com tonight and I can not get rid of it.

I can NOT install ANY of the software listeded here or form other sites.

I do have F-Prot AntiVirus runnign and it finds nothing.
I get a Google Installation Error at each boot, and the Windows Firewall software is turned off at each boot.

Any advise?

  • 2 Contributors
  • 2 Replies
  • 135 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by cohen

Dani AI

Generated

Good practical checklist to follow after reading and : the family of rogue installers that show persistent "installation" errors, disable the firewall or block installers often leave multiple persistence points (startup entries, scheduled tasks, hosts changes and browser shortcut hijacks). The goal is to (1) get a trusted scanner running, (2) remove persistence, and (3) verify and harden the system.

A compact workflow to try (use a clean PC to prepare tools if the infected machine blocks downloads):

  1. Prepare rescue tools on USB (bootable rescue ISO or portable scanners) and boot the infected PC from that media for an offline/full scan.
  2. If you can boot normally but installs are blocked, run a process-killer utility (to stop rogue processes), then inspect startup items with Autoruns or msconfig and disable unknown entries.
  3. Check browser shortcuts (right-click -> Properties) for appended URLs or parameters; check browser extensions and proxy settings.
  4. Inspect and restore the hosts file and reset network/firewall stacks (see commands below). Also check Task Scheduler and Services for unknown tasks/services.
  5. After removal, run a second-opinion scan, install updates, change important passwords, and enable the firewall.

Useful quick checks and commands (run as Administrator):

Path to hosts file:

C:\Windows\System32\drivers\etc\hosts

A simple safe hosts file content to restore:

# localhost
127.0.0.1 localhost

Reset network/firewall stacks:

netsh winsock reset
netsh advfirewall reset

List scheduled tasks for review:

schtasks /query /fo LIST /v

Registry startup locations to inspect:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Backup anything before editing the registry or system files. If multiple trusted offline scanners still find remnants, a clean OS install (after data backup) is the surest way to remove deep-rooted persistence. Preventive notes: keep the OS and AV updated, avoid untrusted streaming/codec downloads, and use limited user accounts for daily work.

Recommended Answers

All 2 Replies

Member Avatar for csgaraglino

This turned out to be a form of the Antivirus 2009. I did not have the traditional files running as services as most of the sites stated, but since my system was jammed up, I followed (cautiously) the links anyway and was ALWAYS presented with buy the Antivirus 2009 software and we "might" be able to fix your problem.

So after several hours I was able to finally get it off my system and here is what I did.

As you may have already read, I was not able to install all the traditional software posted in most of these threads, but I did find one that would install.

Spy Hunter 3 - I came up with this one because every time I tried to go to the site it was blocked. Most of the other software was not... AV09 allowed me to download most of the others and "try" to install them and then killed the install.

So I started looking into the software sites AV09 would not let me go to - after downloading SH3 (Trial Version) on another computer and transferring it to the infected computer I was actually able to in stall it. Right out the gate SH3 said that something was preventing it from install fully and that it wanted to reboot to complete the install.

After reboot SH3 said that "something" had control over my browser and asked if I wanted to block this abnormal activity - of course I said Yes.

It did it's thing and scanned my system finding 124 different issues and as typical wanted me to pay for the full version in order to delete the issues.

But I thought to myself - If it temporally killed the issue with the browser, maybe it killed the issue stooping me form installing other software!

So I tried install Malwarebytes - and bam, it installed great... It found the intruding software, tagged it and allowed me to remove it!

Rebooted, and we are back to a properly running system. I then uninstalled SH3 and we are now running great!

Member Avatar for cohen

Yes Malware Bytes gets rid of AV 09! I have had it on a few of my computers at home and that works everytime!

At least it's fix.

Solved :)

Cohen

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.