Re: Fake anti-virus infection
- From: Questor <Questor@xxxxxxxxxxx>
- Date: Sun, 22 Nov 2009 00:44:47 -0500
I would do these three things.
1. Run the Microsoft Malicious Removal tool as it is already on your system if you are current in your Window updates. It is located at C:\Windows\System32\mrt.exe
2. Download, install, update and run MalwareBytes Anti Malware (FREE) from
3. Download, install, update and run Surer Anti Spyware (FREE) from:
Make sure to download the free version unless you want to pay for the added functionality of the paid version. Their removal capabilities are identical.
Thanks for the response Richard:
I couldn't do #1 as it would be blocked from running and I'd get a pop-up telling me that "mrt.exe is infected and cannot be run".
I've already done #2 and #3. Malware bytes found the culprit:
Trojan.FakeAlert in the users\--granddaughter--\appdata\local\dsqdgk folder
Another file, in the ..\local\temp area held another strange executable. Every time it ran, the name would change by one number. I caught it at 2241.exe. Eventually I suppose that the executables would multiply and fill the HD (160Gb).
The only way I could do any useful work was to dismount the HD from her laptop and connect it to my desktop and run scans on it. Luckily I had a SATA to USB dongle to use.
Once I snapped the HD back in the laptop it sprung to life just fine. All is back to normal with the admonishment to my granddaughter to stay away from links presented on Facebook. She thinks that is where she got it.