Hoping some of you techies can help!

[PhoenixRising]

Ok, so I was surfing the web earlier, and I guess either a virus or a malware application downloaded itself onto my computer. I'm pretty sure its malware, as thats what vista is calling it.

So, basically, its preventing me from getting onto the internet. I keep trying to open IE, but it takes me to a page saying that I need to turn something on to ensure that it protects my computer(I am so totally not tech savvy). And then the browser closes. I keep getting a pop up from my windows firewall saying that its blocking portions of the win32.netsky.q trojan. I logged into save mode, and ran the netsky remova ltoo, bt it said it wasn't on my computer. So I logged back into regular mode, and ran the Windows Defender software, and it caught it and removed it, however, the problem persists. In Windows Defender, it says that the file name is win32/pernefed . It said it was in my internet history, so I deleted that, and repeated the Window Defender scan in safe mode to see it can fully remove it, but it didn't.

So now I'm in a pickle. My bro is looking into it for me, but I figured I may as well ask here. Short of doing a system restore (or whatevere the hell its called), is there anything that I can do that I haven't tried yet? BTW, I'm currently in safe mode to type this.

Thanks for the help! Hope this post made sense!

 

[wirega56]

Ok u need to download spybot and adaware and get yourself some thing like Mozilla firefox and get a better protection

 

[Corny]

what exactly does the browser site say before it closes? this sounds like some kind of virus that tries to force you to buy some removal tool which does nothing. are you sure you got that filename right? win32/pernefed? or is it a virus name?

 

[Corny]

I believe my initial suspicion was right.
It seems this is behind that "pernefed"

Perfect Defender 2009 (PerfectDefender 2009) is a new attempt of Russian web-rascals to make profit on users’ fears. What is worse, the fears are not always groundless. Saying that Internet abounds with malware and viruses, developers of Perfect Defender 2009 does nit lie, because Perfect Defender 2009 is one of thousands programs that belong to malicious software. Perfect Defender 2009 tries to lure users into buying its registered version; to this purpose, trialware is installed. Except creating noisy environment at your PC, trial version of Perfect Defender 2009 or rather associated trojans, demand enormous system resources just to make them unavailable for useful programs.

Try this:

Reboot in Safe Mode

Click on:

My Computer

Local Disk (C)

Now onto folders:

Documents and Settings

* now find the folder with your user name & click it *

Application Data

Google

INSIDE the Google folder DELETE these:

kjzna1562565.exe

spcffwl.dll

the entire folder called TSCAN

now close & go back to your desktop & empty the recycle bin.

RESTART

then:

Files to remove:
PDInstall2009[1].exe
pdfndr.exe
pd.dll
pdmonitor.exe
dfxvideo.dll

Registry Entries to remove
Microsoft\Windows\CurrentVersion\Run\Perfect Defender 2009
Microsoft\PDefender
Microsoft\Windows\CurrentVersion\Uninstall\PDefender
Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Perfect Defender 2009

 

[PhoenixRising]

I believe my initial suspicion was right.
It seems this is behind that "pernefed"




then:

Files to remove:
PDInstall2009[1].exe
pdfndr.exe
pd.dll
pdmonitor.exe
dfxvideo.dll

Registry Entries to remove
MicrosoftWindowsCurrentVersionRunPerfect Defender 2009
MicrosoftPDefender
MicrosoftWindowsCurrentVersionUninstallPDefender
MicrosoftWindowsCurrentVersionExplorerMenuOrderStart Menu2ProgramsPerfect Defender 2009

So, how exactly/where are these file located to e deleted? Do I do this part in regular or safe mode?

I think you're onto it, Corny. It does rediredt me to a page where it asks me to download something.

EDIT: I couldn't find any of those files.

 

[Corny]

This is a guess based on the meager information I have. In my first reply I asked to post more information about the site you are redirected too.
IF those files exist they are most likely within the windows or windows\system directories - use the search tool.

 

[PhoenixRising]

Hi Corny

It does redirect me to the Perfect Defender 2009 website asking me to download the program.

 

[mike_n_herrin]

Looks like this should help you out:

http://www.bleepingcomputer.com/malware-removal/remove-perfect-defender-2009

1. Print out these instructions as we will need to close every window that is open later in the fix.

2. Download Malwarebytes' Anti-Malware, or MBAM, from the following location and save it to your desktop:

Malwarebytes' Anti-Malware Download Link:http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe

3. Once downloaded, close all programs and Windows on your computer, including this one.

4. Double-click on the icon on your desktop named Download_mbam-setup.exe. This will start the installation of MBAM onto your computer.

5. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button.

6. MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan. As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.

MalwareBytes Anti-Malware Screen

7. On the Scanner tab, make sure the the Perform quick scan option is selected and then click on the Scan button to start scanning your computer for Perfect Defender 2009 related files.

8. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.

MalwareBytes Anti-Malware Scanning Screen

9. When the scan is finished a message box will appear as shown in the image below.

MalwareBytes Anti-Malware Scan Finished Screen

You should click on the OK button to close the message box and continue with the PerfectDefender 2009 removal process.

10. You will now be back at the main Scanner screen. At this point you should click on the Show Results button.

11. A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.

MalwareBytes Scan Results

You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.

12. When MBAM has finished removing the malware, it will open the scan log and display it in Notepad. Review the log as desired, and then close the Notepad window.

13. You can now exit the MBAM program.

Your computer should now be free of the PerfectDefender 2009 program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

Associated Perfect Defender 2009 Files:

c:\Program Files\Perfect Defender 2009
c:\Program Files\Perfect Defender 2009\dbbase.div
c:\Program Files\Perfect Defender 2009\pd.dll
c:\Program Files\Perfect Defender 2009\pdfndr.exe
c:\Program Files\Perfect Defender 2009\pdmonitor.exe
c:\Program Files\Perfect Defender 2009\UnInstall.exe
c:\Documents and Settings\All Users\Start Menu\Perfect Defender 2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009\Perfect Defender 2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Perfect Defender 2009\Uninstall Perfect Defender 2009.lnk

Associated Perfect Defender 2009 Windows Registry Information:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Perfect Defender 2009"

 

[PhoenixRising]

Hi everyone

Thanks for all the help. I did a system restore to what I had a few days ago. Things seem to be working ok for now.

 

[wirega56]

Now download spybot and lavasoft adaware (both free) update the definitions then run to clear the garbage out of your system

 

[Alpha1851]

I did a system restore to what I had a few days ago. Things seem to be working ok for now.

The problem w/ relying on system restore, is that the spyware may be hanging out there, waiting to infect your computer again. So, your problem may not be truly fixed. I'm not a computer geek though and could be wrong.

You really should download FireFox and use it as your internet browser b/c it's more secure. Don't know why, but IE is the playing ground for spyware. Maybe b/c it's more widely used. It's sometimes difficult to adapt to change, but FF really is safer. You can download "add ons" that will tell you whether a site is safe before you click on it and are riddled w/ bugs. You might want to try it.