AboutCarolyn Meinel Expertise I cover Windows, Unix, TCP/IP and Ethernet security questions. I do not cover Mac, Palm Pilot, or other networking issues.
Experience Books by Carolyn Meinel: wrote a chapter for The Hacking of America book (see http://www.amazon.com/exec/obidos/ASIN/1567204600/happyhacker)
My article Code Red for the Web for Scientific American was reprinted in the book Best American Science Writing 2002 (see http://www.amazon.com/exec/obidos/ASIN/0060936509/happyhacker). My book The Happy Hacker: A Guide to Mostly Harmless Hacking is now in 4th edition with a Japanese edition (see http://happyhacker.org/hhbook/).
Question QUESTION: Hello Carolyn, and thank you for offering your expertise.
My computer (equipped with XP) was recently infected with a rogue Anti Virus program called, Register Defender Platinum. It wreaked havoc on me by sending pop ups, and slowing the PC to a crawl.After doing much research I found a website called, www.411-spyware.com/registry-defender which advised me to delete the Registry Defender Files, and removed the Registry Defender registry keys. I couldn't find any Registry Defender dll files. Everything works great, and back to normal, but when I try to enable my Mc Afee anti virus supplied by Comcast, it shuts down Internet Explorer. Anytime I try to access a McAfee site, it shuts down IE. I researched and found that this could be attributed to Ad ware or Spyware attaching. The importnat thing is there is no virus protection on the PC.
I greatly appreciate your guidance!!
Vince
ANSWER: I'm assuming you've tried System Restore and it failed. If not, try that, it just might work. If it doesn't, here's what will almost certainly work.
1) Download either Kapersky Internet Security, which offers a free 30 day trial at http://kapersky.com, or F-Secure's Complete Internet security suite, which offers a free thirty day trial: https://store.f-secure.com/cgi-bin/dlreg/ml=EN?ID=FSISTB&desid=TRIAL
2) Disconnect from the Internet.
3) Uninstall McAfee. Chances are good that it has been damaged by Register Defender, so if you decide to try to use it again, you will need to reinstall it from scratch.
4) Install your Internet Security product. Download any updates available.
5) Run a complete scan of your computer. Follow any instructions it might give you.
6) Reboot.
7) Try another complete scan and reboot. Now test to see if you can access the McAfee site.
8) If this succeeded, and if you want to use McAfee instead of the antivirus program that, you'll need to uninstall the antivirus program that fixed your computer first, as it and McAfee will conflict.
9) If neither of these free trials were able to fix your computer, please contact me and I'll tell you how to "nuke" your computer, restoring it to its factory settings.
---------- FOLLOW-UP ----------
QUESTION: Carolyn,
I am delighted to report that thanks to your willingness to share your vast expertise and knowledge, as well as dowmloading and activating the free trial of F-Secure Anti Virus/Spyware, I am now able to sucessfully visit the McAfee and Kapeesky websites which previously I was unable to do as a ersult of the virus.
FSecure detected and cleaned many virus and adware files, except fot the following (please see the report that FSecure generated:
Result: 3 malware found
Trojan-Downloader.Win32.PurityScan.fj (virus)
· C:\WINDOWS\??crosoft.NET\rundll.exe
Trojan.Win32.Inject.dwr (virus)
· C:\WINDOWS\Temp\rasesnet.exe
AdWare.Win32.Mostofate (adware)
· Action: quarantined
Should I be concerned about the above?
I noticed that the icon for the culprit still exists in my lower right hand tray, and I am feraful to even try to right click and delete...please share your thoughts.
Also, Please share your thoughts on whether or not I should stick with the F-Secure, or go back to the McAfee offered free with my Comcast subscription?
I viewed your websites, and I am highly impressed with your credentials!!!
Once again, I genuinely appreciate your assistance, and look forward to hearing your thoughts.
Vince
PS..I am pleaased that I did not have to perform a Destructive Recovery of the PC...did it several years ago, and it took hours.
Answer Hurray, I'm relieved that you got your access to antivirus websites back again. Thank heavens the person who wrote that malware didn't know enough to add F-Secure to the blocked sites.
About the quarantined threats, there should be a way in F-Secure to delete quarantined files. See http://support.f-secure.com for help on how to do this.
If you click on the icon of that malware program to delete it, F-Secure should protect you from harm.
I don't recommend going back to your free version of McAfee as the only protection for your computer. The problem is that it doesn't defend against all kinds of threats. However, McAfee, as well as F-Secure and Kapersky, offer Internet security suites that also defend against adware, spyware, and provide firewall protection that is better than what Windows offers. Alternatively, what I'm doing is running a program that just defends against viruses (in my case, Norton Corporate Edition, but your McAfee wshould be equally good) and have added Zone Alarm Pro to fight adware, spyware, and provide firewall protection. Some of the world's biggest high tech companies use this combination. I don't recommend Zone Alarm's antivirus product, however.
