Fake Security Software Blocking MalwareBytes

timswim78

Diamond Member
Jan 1, 2003
4,330
1
81
I got a call from an out of town friend. His wife's computer has one of those bogus AV programs running. I suggested installing MalWareBytes. He tried that, but the bogus AV software said that MBM is a virus and blocked it.

The computer is running Windows 7 Home Premium, and I am sure that the only current account is an admin account.

What should his next steps be?
 

Iron Woode

Elite Member
Super Moderator
Oct 10, 1999
31,198
12,732
136
1. run msconfig, click the start tab and disable everything, reboot.
2. if msconfig won't run then reboot, press f8 and boot into safemode and repeat step 1.
3. now install MBAM and MSE.
4. slowly restore msconfig start one program at a time.

what fake AV does he have? this can change how you remove it.
 

jackofalltrades

Senior member
Feb 25, 2007
399
0
76
If you research the fake av program you will prob need to download Rkill and run it first then run mailwarebytes rkill will stop the fake av software and then mailwarebytes will clear the problem out.
 

VampyrByte

Junior Member
Jan 8, 2011
19
0
0
I've dealt with a virus like this before. It would block execution of HijackThis, and many other security software's like MBAM. It didn't take me long to figure out that it was filtering exe's by name, rather than with any actual scanning process.

Try changing the name of the program you are trying to run.
 

Harvey

Administrator<br>Elite Member
Oct 9, 1999
35,057
67
91
One sure way to get rid of the problem is:

1. Remove the drive from the machine.

2. Connect it as a slave to another well protected and backed up machine.

3. Copy all critical files to a folder on the second machine, and scan them.

4. Wipe the original drive, and re-install Windows and all software from the ground up.

I know it sounds tedious, and it is, but it could take less time than trying to remove some of the more tenacious fake AV infections, and it's absolutely more certain to remove all of the infection. It's far better than working for hours to remove the infection and thinking you were rid of it, only to find that it comes back later from some hidden file that wasn't removed in the first sweep.

Infections like this are the reason I preach the value of cloning your hard drive immediately after sweeping it for malware. A "cloned" drive is more than a back up for your data. If your main hard drive becomes infected, do your best to save any files since the last backup, wipe it and clone the backup drive back to the main drive. If your main hard drive fails, the cloned drive is fully bootable and operational, and all you'll lose is any unrecoverable files since your last backup.

For Win XP, older versions of Norton Ghost that boot to DOS work very well. For Win 7 and (ugh!) Vista, Acronis True Image works very well between matched drives.

I mount my backup drive in a mobile rack like this one:


When it's not in use, I keep it unplugged from the system because no virus can jump the air gap to an unpowered drive. When it's time to clone the drive, I power down, plug in the drive and clone to it. When it's done, I power down and unplug it.

As long as you're sure your backup is not infected, no virus can take your last good backup point away from you. Worst case, if your motherboard fails, and you can't replace it with the same model, you'll probably have to re-install Windows, in which case, your cloned drive is still as good as any other data backup system.

Good luck.
 

timswim78

Diamond Member
Jan 1, 2003
4,330
1
81
I suggested downloading the process explorer from MS and killing the processes that appeared to be related to the fake AV. My friend did that and was able to nuke the bad software with MalwareBytes.
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |