Hi there,
A friend of mine has a pretty bad virus which I believe to be a Security Defender virus.
He has an icon on his desktop which frequently pops-up saying he has viruses etc. on his PC and it requests that he order the "Security Defender" software. I am certain this is a virus.


I asked him to download SUPERAntiSpyware and Malwarebytes' Anti-Malware free edition to perform scans. Threats were detected and removed however the Security Defender pop-ups persist.
How can I help him clean his PC?


Any help is greatly appreciated. HELLO and welcome to Computer HOPE Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security PROGRAMS may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. ABSENCE of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
**************************************************
This will not run if you have AVG on your computer. If that is the case, let me know and I'll give you some free AV's and a tool to remove AVG.

Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.

link # 1
Link # 2
If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main TAB
* Set to "Always ask me where to Save the files".

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Right-click combofix.exe and select Run as Administrator and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.Quote from: SuperDave on February 11, 2011, 05:10:28 PM

Post the ComboFix log and a new HijackThis log in your next reply.

Did you want a HiJackThis log as well?
If so, do you have a download link?

• Double Click the HijackThis icon, located on your Desktop.
  
• By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
• Accept the license agreement.
• Click the Open the Misc Tools section button.
  
• Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
  
• Please post the log in your next reply.