Spyware, viruses, & security forum: Another fake warning screen

Got rkill onto the computer. In SAFE mode, when I click on rkill the warning screen pops up. When I click on rkill again with the warning screen still showing, the screen flashes and then there's just the warning screen again. No rkill. Third, fourth, and fifth attempts all yielded the same result.

Now what?

*

After successfully running Rkill, or whichever tool works, do NOT reboot. Immediately update MBAM and run a scan.

Earlier I was able to get onto IE although there was no internet connection. Now when I click on the IE icon (single click on the bottom task bar or double click on the desktop icon, either one) the fake warning immediately pops up. I can't get at anything.

I'm thinking that maybe it's time to upgrade to Win8 anyway, and if I install that (I have to do a complete reinstall on this computer, not just an upgrade) that should wipe out this virus in the process. Will it be that simple, or will the virus interfere with the new installation process? But I hate to give up. Any other suggestions for solving the problem before I go to Plan B?
*

But there is Windows 7 and IE8.
1. If you are to fresh install the OS (a clean installation), then the malware may go away.
2. If you are to run an upgrade install of the OS, the virus won't go away.

If you will do #2, you need to try removing the malware before upgrading to Windows 7.
Hope you've tried the other suggestions of Carol e.g. by using other format of Rkill.

You don't need rkill if you will turn on the system to safe mode.
If nothing works, please try this:
1. Reboot the computer to safe mode with networking
2. Download Hijackthis (the executable version) from http://free.antivirus.com/hijackthis/
3. Run HijackThis then put a check mark on the F2 entry that have antispy.exe on it, and then click "Fix checked" button.
4. Reboot the system to normal mode
5. Scan using Malwarebytes after updating the database.

Continue to try rkill (any format) in normal mode. If there's no way that rkill is killing the fake MSE trojan alert while it is open or not (the fake alert), you can start the other method (by using Hijackthis to fix the F2 entry that has antispy.exe).

Just don't put a check mark in all entries that Hijackthis will display but the F2 entry only, that points to antispy.exe.

Again, good luck.

Reboot, press F8 during the boot process. Next, select Last Known Good Configuration, then press ENTER.

If that does not fix your problem then try a system restore using the System Restore Wizard. To use the System Restore Wizard, make sure you're logged on as an administrator, and then follow these steps:

1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.

2. On the Welcome screen, click Restore my computer to an earlier time, and then click Next.

3. On the Select a Restore Point page, select the date from the calendar that shows the point you'd like to restore to (perhaps the day before your problem appeared), and then click Next. Keep following the screen prompts, until your system reboots itself in Normal mode.

Hopefully, the problem will have gong away without having to reinstall all your software.

You didn't mention when you went into safe mode that you tried System Restore in safe mode.It gives you an option to continue with safe or go into system restore.I DID THIS AND GOT RID OF MY VIRUS.DO SAFE AGAIN AND WATCH FOR THIS BOX IN THE CENTRE OF THE SCREEN.

I don't usually consider myself stupid, but every now and then I wonder.
I have never had occasion to use System Restore and I thought it wouldn't work here because I have never manaully set a restore point.
Dumb. The computer sets restore points automatically on a regular basis. Duh!
So after I hit F8 to go into Safe Mode, I clicked NO (Read the prompt carefully, as I did not) and went into System Restore. I chose the last date before I knew I had this problem, and, well, what a surprise. . .it worked. My wife's computer is back in business.
But in any case I appreciate all the help you guys gave.

NTG

www.superantispyware.com

Good luck!

Technophobe Julie

The bottom line of this thing appears to get you to buy one of the software packages they offer to fix this problem, wrong assumption. The bottom line is to get your credit card number and, I'll give you one guess what happens after that.

When this piece of crap landed on my computer I went through various steps to remove it, none of which seem to work. The fact that I was unable to launch any browser on my desktop didn't either.

What saved me was I also had a laptop so I was able to get some info on this thing.

I downloaded a piece of software titled "SUPERAntiSpyware". The version I downloaded was their free version. Copied it to a flash drive and plugged the drive into my desktop and ran the software from there. It got rid to this crap.

Eventually I downloaded and bought the upgraded to this software and run it every time I boot up. I run it along with Nortons Internet Security software.

The SUPERAntiSpyware software really catches all sorts of things on my computer, isolates them, and then kills them when I tell it to.

A word of caution: Do not be dumb like me. Before the Alert software installed itself on my computer I was running without any security software. Considering the amount of time I spent getting this thing off my computer, a few bucks spent buying and installing security software is worth it.

Hope this helps.

ceb39

Downloaded Mozilla Firefox, Spybot, Malwarebyte, and a little unpaid help from Dell. So far so good. Switched from Internet Explorer to Mozilla Firfox, but once in a while the screen will pop up again that started the whole mess but learned my lesson the first time. I quickly delete the screen and sometimes shut down to be safe, then run my Malwarebyte and then Spybot. But because of how Mozilla Firefox works it is easier to spot the screen when it pops up and delete. I'm afraid to go back to Internet Explorer because of this.
Hope I have been of some help Thought I was going to have to spend a couple of hundred dollars to fix this, but not so far.

Wiping and starting over is certainly an option, but booting into Safe mode and then following the prompt to get to system restore proved adequate.

I have a question, though. Now that I've done that restore, is the trojan still in there somewhere, only without a registry entry to get it started? If so, is there a way to find it and truly delete it? Anybody know for sure?

*

I got the exact one on my windows xp ,pentium 4 about a year ago now, so me thinking well im knackered but but by chance i got a great pc cheap, then three weeks later i went to take my p.c away and there was nowt wrong with it. But when this trojan hit all it was looking for was credit-card details and would not allow me in to any of my programs,no-internet,every-time i tried to go anywhere on my p.c this credic-card details ect. But to be honest i still have a word document with everything it tried so hard to do and as i dont ever use the net for banking what so ever, to be honest i left it thinking it was a gonner but now it's brand new again.

11 virusis 2 weeks ago on the easter long-weekend + 24 a few days later,moral of this quick story is yet again Defener boxed them off and i just pressed the remove button efore writing down what it was ect...now as windows 7 pro needs a back-up i am stuck as i put the dvd in press back - up then a box appears and stops the whole thing tried 3-times now. I am now really baffled HELP GOD FOLKS ???HELP IM SINKING.