Expert: Brian Benosky - 2/19/2010

Question
Hi,
I just got the Bankerfox.a virus I believe thats what the false messages are saying. I couldn't find something that would work as the virus would block out the program stating "application cannot be executed. The file _____ is infected. Do you wan to activate your antivirus software? I came into the Win32 one before but after 3 hours, my computer managed to fix it by itself. Can you please help me in laymen's terms?

Thanks,
Emily

Answer
Hi Emily

BankerFox.A is not a real virus. It is only reported by a rogue security program which has already infected your computer. Do not buy anti-spyware or anti-virus applications that warn you about BankerFox trojan. They are only out for your credit card information.  Please print out and follow these removal instructions:

Restart your computer.  Before the Windows logo appears, keep tapping the F8 button continuously until a menu screen appears.  Choose to Boot Windows into Safe Mode With Networking.  Once in safe mode, open a browser and download Malwarebytes' Anti-Malware to your desktop from here:
http://www.besttechie.net/tools/mbam-setup.exe
Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to
    o Update Malwarebytes' Anti-Malware
    o and Launch Malwarebytes' Anti-Malware
* then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.  Please save it to your desktop.  Reboot your computer normally.

After rebooting, please download HijackThis to your desktop from here:
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in your follow-up to me, along with the Malwarebytes' log which you saved previously.

Brian