virus

[roystheboy]

Hi my grandson has a laptop runing Windows 7 and he just rang me because when he starts up his laptop he gets a message saying he has 365 viruses and this hapens everytime he starts it up is there anything can be done to fix it ,is there a program that can fix it or can he restore to an earlier date I dont know what to do to help him hope you guys can give me some advice cheers take care best regards

[Taf]

It sounds like he has a scammer on his PC... they often report huge problems where in fact there are none.

Then they offer a fix program you have to pay for.

Often these rogue programs can be removed using standard free AV's such as Malwarebytes, Avira or whatever. Plus you could try spywareblaster or (also free).

[roystheboy]

hi couldnt find anything with malwarebytes cheers

[Kymmy]

That doesn't stop the original fault then.. He'll need to check his start-up files (either in the registery or via MSconfig) and find the file giving the false reports (remembering that if a program is already active it could be giving out more than just a false report...like bank details, passwords..etc..)

[roystheboy]

thanks I have done spybot and windows washer malwarebytes and there is nothing ,I have done misconfig and untickrd three programs and restarted it and there is nothing comeing up at all is there anything else that I can do cheers take care

[Kymmy]

Which programs did you untick? The paths/names to these will give you an idea of what to remove in the registry and the file structure

[roystheboy]

not sure what they were but there is no virus scare there anymore I rebooted the Pc and no virus warning came up keep your fingers crossed hope its gone thanks cheers for everything take care best regards

if its a bogus AV then you need to stop it running before you run any anti malware program or it will not work

You need to find the name of the bogus AV and google it with the peramiter (AV name) bleeping computer. If its known you will be taken to instructions for removal

In my experience bleeping computer has the best and easiest guide to the removal of these fake AVs and I have had success with lots of machines this way

[Web-Junkie]

There was some malware that changed the logon shell, called 'hotfix.exe' that ran as the new shell, CTRL-ALT-DEL and killed the hotfix.exe in Task Manager program and then ran explorer.exe from the File > New Task menu which then let me run REGEDIT and found the registry key had been hijacked by malware!!

Just check this registry key:

HKEY_LOCAL_MACHINE>Software>Microsoft>WindowsNT>Cu rrentVersion>Winlogon

and check that 'Shell' = explorer.exe

If it isn't, change it to explorer.exe then find the program that was there and delete it!!

[roystheboy]

thanks guys my grandson has talking his laptop back now lets hope its O.K. now I cant thank you people enough cheers take care best regards