[Octohedral]

My computer got these antivirus software messages coming up from 'security shield'. It was obviously a virus so I disconnected from the internrt and shut my computer down.

However, I then very naiively looked for advice on the internet, and most results told me to put it in 'safe mode with networking' and doenload something called PC Tools. I did this (stupid, I know), and it appeared to subdue tne virus, but then asked me to pay to get rid of it completely. I've looked around and I'm fairly sure PC Tools is part of the Security Shield scam, though it might not be.

I uninstalled PC Tools, but Security Shield is almost impossible to get rid of manually. It also stoppef my antivirus (Microsoft) from working. The antivirus now works and it can't detect a virus, but I don't think Security Shield is gone. PC Tools may have done something, but I don't want to connect to the internet because I think it's still there.

Please help!

[Octohedral]

PS I know I should have taken it to a professional, but I have exams next week and no money.

[mrnightcat]

Using a different computer or the infected computer (if you're still able to), download Malwarebytes Anti-Malware (free and absolute best solution) - in the "save as" box before download, rename it so that the virus doesn't immediately discover it as a blacklisted program, or it'll block it like your other antivirus. If you used a different computer to download it from, stick it in a USB then run it on your PC.

You should be able to run it. If not, try again and make sure you both rename the installation file and are not using the infected computer to download. Start it, run a full scan and leave it for a few hours to work. Malwarebytes should completely erase the virus including its infected registry entries, as it has for me several times in the past. I really don't know why other antivirus programs still can't deal with this - just like yours, my McAfee has never managed to catch it.

It's a very nasty virus designed to make you panic, but Malwarebytes should sort it providing it hasn't evolved.

[Octohedral]

Thank you so much! Trying it now.

[Octohedral]

I ran it twice, and both times it detected a single trojan, and claimed to get rid of it.

The virus is clearly not actively attacking my computer any more, but I somehow feel I haven't got rid of it - due to the fact the antivirus detected a second trojan, and that the PC Tools thing said it wouldn't get rid of it without money, so I doubt it has. Apparently it can also damage your computer and steal passwords, so I suspect the PC Tools programme disabled it, but that it's dormant somewhere on the computer, and not necessarily safe, but can't be properly detected by the malwarebytes software.

Anyway, our university network has very good virus detecting software, and my computer hasn't been cut off yet.

Not sure why I'm telling the internet this

If anyone has any other advice, it's much appreciated - otherwise I'm going to keep using the internet, unless it gets cut off, but without going on important sites like internet banking, (it might be able to get my passwords anyway, but that lowers the risk), then take it to someone after my exams. Hopefully, I'm just being paranoid.

[Iqbal007]

(Original post by Octohedral)
I ran it twice, and both times it detected a single trojan, and claimed to get rid of it.

The virus is clearly not actively attacking my computer any more, but I somehow feel I haven't got rid of it - due to the fact the antivirus detected a second trojan, and that the PC Tools thing said it wouldn't get rid of it without money, so I doubt it has. Apparently it can also damage your computer and steal passwords, so I suspect the PC Tools programme disabled it, but that it's dormant somewhere on the computer, and not necessarily safe, but can't be properly detected by the malwarebytes software.

Anyway, our university network has very good virus detecting software, and my computer hasn't been cut off yet.

Not sure why I'm telling the internet this

If anyone has any other advice, it's much appreciated - otherwise I'm going to keep using the internet, unless it gets cut off, but without going on important sites like internet banking, (it might be able to get my passwords anyway, but that lowers the risk), then take it to someone after my exams. Hopefully, I'm just being paranoid.

If you haven't got anything important on the computer, just do a fresh install or recover it a previous point before you got that product than run your anti-virus to check over.

[mrnightcat]

That's rather concerning, sorry to hear that it didn't get rid of it. Did you make sure to run a full scan instead of a quick scan? Ignore anything that charges money for getting rid of things. You say you installed PC Tools, was that following people's advice, or prompts from the virus/program? It sounds like PC Tools may be part of it or a separate fake software. Software that claims to detect viruses but prompts payment before deleting is always some sort of scam.

As the other person said, try restoring the computer to an earlier date, though the virus does tend to delete all restore points so it may not be possible. Either way, don't take it to a professional just yet until all options are exhausted.


This was posted from The Student Room's iPhone/iPad App

[mrnightcat]

This is the best guide I've read on removing it. It does use Malwarebytes to remove it, but there are many more steps which I didn't put in here, so hopefully it may work for you this time.

http://www.bleepingcomputer.com/viru...ecurity-shield


This was posted from The Student Room's iPhone/iPad App

[Octohedral]

It just reappeared out of nowhere

(Original post by mrnightcat)
That's rather concerning, sorry to hear that it didn't get rid of it. Did you make sure to run a full scan instead of a quick scan? Ignore anything that charges money for getting rid of things. You say you installed PC Tools, was that following people's advice, or prompts from the virus/program? It sounds like PC Tools may be part of it or a separate fake software. Software that claims to detect viruses but prompts payment before deleting is always some sort of scam.

As the other person said, try restoring the computer to an earlier date, though the virus does tend to delete all restore points so it may not be possible. Either way, don't take it to a professional just yet until all options are exhausted.

Thanks - I suspected PC Tools was part of the same scam. I deleted it, but I don't know what else it's done. I did it because I searched on my phone for ways to get rid of security shield, but I didn't realise until afterwards that there were loads of websites suggesting PC Tools, and they didn't look very legitimate. Stupid thing to do.

(Original post by Iqbal007)
If you haven't got anything important on the computer, just do a fresh install or recover it a previous point before you got that product than run your anti-virus to check over.

Thanks a lot, I'll try that It might not work with this, but I guess it's worth trying.

(Original post by mrnightcat)
This is the best guide I've read on removing it. It does use Malwarebytes to remove it, but there are many more steps which I didn't put in here, so hopefully it may work for you this time.

http://www.bleepingcomputer.com/viru...ecurity-shield

Brilliant, thank you! I'll try this and the computer recovery.

Thanks a lot for all your help!


P.S. Will rep tomorrow

[battaliou]

(Original post by mrnightcat)
Using a different computer or the infected computer (if you're still able to), download Malwarebytes Anti-Malware (free and absolute best solution) - in the "save as" box before download, rename it so that the virus doesn't immediately discover it as a blacklisted program, or it'll block it like your other antivirus. If you used a different computer to download it from, stick it in a USB then run it on your PC.

This solution worked for me. I was confident to download Malwarebytes as it was hosted on CNET (originally founded in 1994 by Halsey Minor and Shelby Bonnie) http://download.cnet.com/Malwarebyte...-10804572.html