The laptop has a spyware infection and security is compromised can you help please

katies_mum

I have been on my daughters laptop for the last week, was just browsing and got the following message

Vista Internet Sec 2012 has blocked a programme from accessing the internet.

Control.exe is infected with Trojan-Brulc.win32.keylogger.gen (think the brulc bit is right but was making a note so fast I can`t read my own writing)

I`ve got an avast scan running and it has been upto date all the time

Internet Explorer alert
\visiting this site may pose a security threat to your system (it won`t let me go onto anything)

c:\users\katie\appdata\local\rej.exe

then a message to say PC is being monitored

Now a Vista security Alert! vunrabilities foung
Your system was scanned for security breaches. Attention 29 serious issues were detected.

Keep getting a pop up box saying something is trying to attack the computer, also avast is showing as not fully protected now is this because I have the scan running?


Please can anyone help as can`t do anything with the laptop and I`m scared incase I make it worse (I do allmy banking etc online and am worried sick) I was only on trip advisor when this happened.

katies_mum

the laptop has just shut down, not sure if I should restart it.

davb

You need to scan with Malwarebytes - all these messages are a virus trying to fool you into paying out money to remove it.
Download from here (possibly on another PC) http://www.filehippo.com/download_malwarebytes_anti_malware/
Install, update, quick scan, fix what it finds, and post the log here.
If it won't install, post back.

katies_mum

Thanks, I am on a netbook at the moment. Laptop has just restarted itself and message is Vista Internet Security 2012 has blocked.....Attention Danger! and it won`t let me log into anything just keeps popping up on the screen.

katies_mum

I put the details filehippo.com in and it looks like it is trying to get to that site but the Internet Explorer alert keeps taking over/.

davb

Follow the instructions here then:
http://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012
You may need to download the files on your netbook and put them on a USB stick.

katies_mum

Hi
I have been able to follow this to point 4 but this Internet Explorer alert won`t let us open rkill it keeps over riding it.

Browntoa

try ALL the variants of Rkill

http://www.bleepingcomputer.com/download/anti-virus/rkill

if one opens a black box and kills processes then you are in business

seafarers_wife

thanks so much for this, my laptop has just decided to show this about an hour ago so im now following the instructions on a clean un networked computer after switching off my wireless network on the laptop to hopefully get it working. its so annoying as i only went onto the next website and then it came up with it.

PHYTHIAN

katies_mum wrote: »

Hi
I have been able to follow this to point 4 but this Internet Explorer alert won`t let us open rkill it keeps over riding it.

You need to rename rkill see the end of point 5 on bleeping computer

If you continue having problems running RKill, you can [COLOR=blue! important][COLOR=blue! important]download[/COLOR][/COLOR] the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.

Do not reboot your computer after running RKill as the malware programs will start again.

Browntoa

when you have finished your scans seafarer start a new thread of your own and post the log files swcan check them