My daughter was using my laptop this evening when a virus warning appeared on the screen, saying 38 viruses detected. When I looked at it the message was from system tools and not AVG, which is installed on the laptop. It was cleary a scam site as it directed you to pay money to resolve the fake problems. It wouldn't let me run the virus scanner or download any other malware fixing tools.

After some searching on the net, I found the solution by starting in safe mode and restoring the system to the previous day.

The laptops back to normal, so now I'm trying MS security essentails.

Anyone else had this problem?

My daughter was using my laptop this evening when a virus warning appeared on the screen, saying 38 viruses detected. When I looked at it the message was from system tools and not AVG, which is installed on the laptop. It was cleary a scam site as it directed you to pay money to resolve the fake problems. It wouldn't let me run the virus scanner or download any other malware fixing tools.

After some searching on the net, I found the solution by starting in safe mode and restoring the system to the previous day.

The laptops back to normal, so now I'm trying MS security essentails.

Anyone else had this problem?

Yes I know a few folks who've had things like this lately.

They've all had some sort of anti-virus installed as well, whether it's AVG, MS security essentials or avast, they still seem to have got through.

Not saying this is the case here, but it's all been people who think they know more than they do, and are the sort of folk who just blindly click yes or accept to anything that pops up on screen without reading it first.

I know a few people that had it - safe mode is the only option

All down to people hacking into an Ad agency http://www.bbc.co.uk/news/technology-12608651

Thousands of sites were effected!

Tom

Yes I know a few folks who've had things like this lately.

They've all had some sort of anti-virus installed as well, whether it's AVG, MS security essentials or avast, they still seem to have got through.

Not saying this is the case here, but it's all been people who think they know more than they do, and are the sort of folk who just blindly click yes or accept to anything that pops up on screen without reading it first.

http://www.bleepingcomputer.com/virus-removal/remove-system-tool

This worked for me, not on my machine mind you lol.

Firefox + adblock

Will prevent a repeat.

Banner ads are a popular target for crackers and spam pedallers these days.

not used adblock - i do use noscript - prevents anything downloading without my knowledge.

OP: i would download and run Spybot Search & Destroy, the scan plus immunize, then I would run CCleaner to tidy up.

Next, run an online virus scan from someone like Trend. They are free.

After the above is complete your PC will be nice and clean and free of adware and spyware.

Not even safe mode will a "Normal" av program get rid of it; as I found out when a friend called me over on Sunday.

You need to use some fairly technical programs that can potentially screw up your windows install.

If you run another AV program the malware fools it into thinking there is nothing wrong, assuming you can get passed the blocking it uses to stop you GETTING another av program!!

I had to go to Safe Mode with Networking and download COMBOFIX to get rid of the main malware program, then run my other av programs to pick up all the secondary infections.

Go here and ask for help, they will talk you through using Combofix and other specialist tools

Spybot will kill it. And it's harmless.

I have had this 4 times in the last week on peoples computers....did a system restore on one back to a couple of weeks ago (just to be sure) and the next day he phones again with the same problem...I can only assume one of the sites he goes on (football forums usually) has been hacked into.

MSE, Sophos, AVG doesn't detect these at all for some reason. Nice little earner for me though

Malwarebytes Anti-Malware (free download) did it for me when all else failed. Tocuh wood it has not returned. When I tried other malware removers it seemed to go, had the pc support guy check it over and all seemed fine, except it came back 2 days later.

Tried the Malwarebytes app and it detected all the corrupted files (Sophos and AVG missed these) and deleted.

Just picked another one riddled with this,.................Kerching ££

Just picked another one riddled with this,.................Kerching ££

Snap.

Sigh...just had a call from my bosses wife. "System tools: your computer is infected...."

Sigh...just had a call from my bosses wife. "System tools: your computer is infected...."

Call her back .........£20, half what the scammers want, comes with a free virus check as well !!!

Malwarebytes Anti-Malware (free download) did it for me when all else failed. Tocuh wood it has not returned. When I tried other malware removers it seemed to go, had the pc support guy check it over and all seemed fine, except it came back 2 days later.

Tried the Malwarebytes app and it detected all the corrupted files (Sophos and AVG missed these) and deleted.

Missus did the same, windows 7

Mine XP was showing signs of the same but no system tool poping up.

Both got malwarebites downloaded and run and all good now!

Malware Bytes to the rescue again

Malware Bytes to the rescue again

I downloaded malware bytes last night and ran the scan, it showed one nasty still on the laptop. I then ran spybot search & destroy and that showed up another 6 nasties present.

I downloaded malware bytes last night and ran the scan, it showed one nasty still on the laptop. I then ran spybot search & destroy and that showed up another 6 nasties present.

Did Spybot want to run another scan on startup? If not then great!

Here's a command to run spybot automatically or automatically and silently from the Start, Run box.

"C:\program filesa spybot - Search & Destroy\spybotsd.exe" /autocheck /autofix /autoclose

"C:\program filesa spybot - Search & Destroy\spybotsd.exe" /autocheck /autofix /autoclose /taskbarhide

Providing that you have installed it in Program Files

You can get it to Update as well, but i've seen that it needs you to run the command again. So I normally run spybot, update it and close it then run the above. You can run SDUpdate.exe from start and run to run an update without going into the program.

The other switch you can run is /autoimmunize This will protect Firefox, IE and Safari from known nasty websites.

Might have already been mentioned but these little blighters can also infect your 'system restore' folder thus lulling you into a false sense of security.

Id be inclined to delete your 'Temp' folder in c:\windows, directory, then also delete it in (temp folder) Local settings folder within 'docs&settings' folder.

Boot in safe mode F8 and 'Safe mode with network support' and delete the 'system restore' folder first.

Then run something like Eset Online scanner or Trend Housecall which download a small app to your machine and are quite good at complete removal

Once done as has been said before run CCleaner and install Spybot/Malwarebytes and run again for good measure.

Reboot and uninstall your previous AV and load it again or try another AV product.

AVGFRee a bit resource hungry at the moment(unless you start adding exclusions) so would recommend AviraFree as an alternative unless you wish to go down the purchase route.

Good luck!

ps.Dont forget to turn 'System Restore' back On afterwards!

Edited 5 March, 201115 yr by swordstoke