How JustAnswer Works:

  • Ask an Expert
    Experts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional Answer
    Via email, text message, or notification as you wait on our site.
    Ask follow up questions if you need to.
  • 100% Satisfaction Guarantee
    Rate the answer you receive.

Ask Justin Your Own Question

Justin
Justin, Network Administrator/Not Limited
Category: Computer
Satisfied Customers: 2551
Experience:  Network Specialist Degree, A+/Net+ Certs, 10 years Contract IT/Network Administration
Type Your Computer Question Here...
Justin is online now
A new question is answered every 9 seconds

Windows keeps telling me that EVERY download has a virus and

Resolved Question:

Windows keeps telling me that EVERY download has a virus and has been deleted, including billing from 1&1 internet and the download that I just attempted to do from H&R Block. What the heck is going on???????
Submitted: 2 years ago.
Category: Computer
Expert:  Justin replied 2 years ago.
Greetings.

Please read: Remember to click the Accept button ONLY once your issue is resolved. If the first answer does not work, just REPLY to me and we will continue.


Sounds exactly like a rootkit virus. Follow my steps below for removal.

So you don’t lose me on a restart, I recommend setting up your JA account. Click My Account on the top right, then Edit Password. Click Save Changes once finished. To return to me, either bookmark/favorite this page, or go to http://www.justanswer.com and click My Questions at the top right. If you don’t see My Questions, you should see Login in which you can sign in with your email and the password XXXXX just created.



Restart your computer into safe mode with networking. To do this, restart the computer. Immediately following the splash screen (First screen you see, might say dell/hp depending on manufacturer) start tapping the F8 key. When done correctly, you'll get advanced startup options.

Select safe mode with networking.

From safe mode with networking, or before you boot to safe mode with networking, click this link and download the file.

http://tinyurl.com/justinmal

Install it (Malwarebytes), its free so don't purchase it. Run a full system scan. When completed, click Show Results and then click Remove Selected and restart if prompted. That should get rid of the infection.

Let me know the results when completed, might take take a bit to do the scan

Customer: replied 2 years ago.

Okay, I tried downloading from the link you gave and was told IT has a virus! LOL

 

I'm also not getting a response when I hit F8. I have an HP Pavilion dv7-4080us and am holding down the fn key as I hit f8 but the computer just keeps restarting like normal and comes up like normal. :-(

Expert:  Justin replied 2 years ago.
Its a timing thing, this HAS to be done from safe mode in this case.

You need to really hammer the f8 key after the initial splash screen, its done before windows starts. If windows begins to start before you see the advanced start options, you just need to work on your timing.

It WILL stop starting and give you that screen when you get it correctly. The virus shouldn't run in safe mode so it will give you the availability clean it at that time.
Customer: replied 2 years ago.
Okay, I'm off to hit the F8 key starting while the screen is still dark! Cross your fingers. LOL
Expert:  Justin replied 2 years ago.
No problem, you'll get it, just let me know progress.
Customer: replied 2 years ago.

Justin, you are NOT going to believe this.

 

I ended up not going through restart, but simply pushed the power button to shut the computer down, then turned it back on again -- knowing that an an additional screen would come up and hoping it had the safe with networking option. It did and everything came up.

 

Brought up IE, typed in the link and downloaded the file.... and was told it contained a virus and the computer deleted it!

 

???? help? LOL

Expert:  Justin replied 2 years ago.
Virus is running in safe mode as well.

Do you have another computer that you can download the file to and copy it over with a flash drive or burn it to cd?
Customer: replied 2 years ago.
Sorry, but no. :-(
Expert:  Justin replied 2 years ago.
We'll likely need one.

I'm assuming you created your password XXXXX the justanswer account.

So I'd like you to try this next.

Go to start > all programs > accessories > RUN.

Type inetcpl.cpl and hit enter. Click the advanced tab, thenc lick restore advanced settings, and then click reset.

Click reset once more.

Click this link:

http://www.hitmanpro.nl

Click downloads. Select the second one in the list for 64-bit systems and try to Run it.

If you can, let me know.
Customer: replied 2 years ago.

Okay, I'll try that.

 

BTW, I have Webroot Antivirus on here. Got it when I bought this thing.

 

Cross your fingers... again!

Expert:  Justin replied 2 years ago.
Webroot is awful unfortunately.

You may want to try the above steps I gave you in safe mode as well.
Customer: replied 2 years ago.

Just tried without safe mode and got the same virus reply.

 

I'll go try it in safe mode.

 

Which antivirus/malware/etc. do you like?

Expert:  Justin replied 2 years ago.
Avast.

Really though, you're going to need a secondary computer to initiate the download at this juncture if its catching them all.

Give it a shot in safe mode though, we'll see. If you just recently got the infection, you may try a system restore in safe mode as well.

Start > all programs > accessories > System Tools and roll back to date prior to the infection. Do this from safe mode as well. Keep me posted.
Customer: replied 2 years ago.

Safe mode didn't work and, unfortunately, I first noticed this in email attachments quite a while back. Didn't think anything of it until it told me that my 1&1 internet invoice had a virus.

 

Okay, it looks like I'm headed to Staples to pick up a thumb drive and ask the guys there if they'll let me download the two files you gave me.

 

What do you think?

Expert:  Justin replied 2 years ago.
If you can get even one of those files to run, it'll VERY likely clean the virus.

Certain very nasty infections though will stop the antivirus from attempting to clean anyway.

what is the exact error, word for word you get, when downloading/running one of the files.
Customer: replied 2 years ago.

There's a red shield with a white X in it then " [file name] contained a virus and was deleted. Learn more." When I click learn more, the Windows help section on installing antivirus software, etc. pops up.

 

There's no error number or anything like that.

Expert:  Justin replied 2 years ago.
Yeah, sounds like a root kit personally.

When you installed webroot, it should be your antivirus, nothing else. And its not.

These rootkits pretend to be antiviruses, and just take over the system. Eventually it'll try to get you to "buy it" but DO NOT, as you'll be suffering from identity theft shortly after.

I'd remote in if I thought it could but it would also treat it as a virus, I run across these often, hard to get rid of. Best bet is to get those antiviruses up hitman and malware, and see if they can clear it.
Customer: replied 2 years ago.

Okay. Times like this I almost wish I was back in corporate finance with my techy gurus. LOL

 

I moved to the country but, unbelievably, the small town I live in has a Staples that is nearly around the corner. I should be able to make it there and back in a half hour. I just hope that there's a sympathetic guy there who will download the two files for me! LOL

 

We should know in an hour or so. Talk to you then!

Expert:  Justin replied 2 years ago.
No problem, just tell him you already know its an infection, you just can't run the tools because you believe its stopping them in safe mode.

Customer: replied 2 years ago.
Will do! Thanks, Justin!
Expert:  Justin replied 2 years ago.
Talk to you soon.
Customer: replied 2 years ago.

Well, found a nice guy to download the two files at Staples, got home, loaded the first one, ran a full system scan and almost one and three quarters hours later.... I tried opening something and still got the virus message. (It did find one thing, but it wasn't rated as bad. I deleted it anyway.)

 

I'm now going to load the hitmanpro one and see what happens.

 

Ann

Expert:  Justin replied 2 years ago.
Alright, kind of surprised that malwarebytes didn't pick up more.

Keep me posted
Customer: replied 2 years ago.

Hitmanpro found something. I think it just deleted it. LOL

 

I'm going to reboot and check an attachment and see what happens.

Expert:  Justin replied 2 years ago.
Did you catch the infection name?

Also, you should try running malwarebytes (system scan only) and hitman in regular windows, not just safe mode.
Customer: replied 2 years ago.

Actually, I ran both in regular windows.

 

I just re-rean hitman. It identified something called gcinstall.exe in a file called Wild Tangent app. ?? "contains a high amount of malware related properties" I don't remember ever loading anything called Wild Tangent.

 

I'm holding it at the hitman screen that says "close all applications and click Next to remove malicious software"

 

I'm assuming I should shut this down and click Next. LOL But I'll wait until you tell me whether there's anything else I need to do.

Expert:  Justin replied 2 years ago.
Yeah that's fine.

When finished though if its still acting up, there is the off chance that the virus scanner itself went nuts. I've seen AVG do similar systems.

So I would recommend removing Webroot or any other antivirus software on the system (can reinstall it after).

To do this, start > control pane. Programs, remove webroot and any others, and restart. I expected a lot more infections found, so we we'll need to start looking at others.
Customer: replied 2 years ago.

Okay, I'll go ahead and click next and check an attachment.

 

If it still gives me a virus message, I'll remove webroot and make sure no old ones are still hanging out there -- I had Norton 360 before. Then I'll try another file.

 

Are we having fun yet? Cool

Expert:  Justin replied 2 years ago.
The only issue really is that that we can't download files or we'd have tons of options to play with.

I'm betting chrome wouldn't exhibit these symptoms as a browser.

Doubt you have it installed though.


Norton can cause this too, but you would have noticed it right away. Let me know the results of webroot removal
Customer: replied 2 years ago.

Okay, I deleted Webroot, ran the justinmal and hitman scans under safe mode and still just got a virus message.... on an excel file that I attached to a client!

 

Unfortunately, I don't have chrome installed. I've heard of it, but I've always worked with ie.

 

I did find a Norton file still there that connected to my offsite backup... which I no longer use, so I deleted it.

 

 

Expert:  Justin replied 2 years ago.
Its for sure your antivirus. Whether left over traces of it, or whatever. Probably or possibly due to the virus you had, or maybe a failed update.

We can confirm this though.

Go to start, all programs. Look for Internet Explorer 64-bit. Run it. Browse to a file to download and download. See if it works inside IE 64.

If it does, my suspicions are correct and there's still some anti virus software on there or a left over trace of some. Hard to determine without seeing what's installed.
Expert:  Justin replied 2 years ago.
Also, are you sure you don't have AVG, or spybot search and destroy installed? Let me know when you post results on IE64-bit
Customer: replied 2 years ago.

OHMAGOD!

 

You're 100% correct! I did the ie 64 bit and went to justinmal and it downloaded without a problem.

 

Interesting. LOL

Expert:  Justin replied 2 years ago.
No, makes complete sense.

Its still left over damage from your antivirus. Could even be Norton.

Do this, using Internet Explorer 64-bit. Download these two tools. You'll want to login justanswer with the 64-bit IE so you can do this.

1) Norton removal tool:

https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?docid=20071130124653EN&lg=english&ct=united%20states&product=home&version=1&pvid=f-home&entsrc=redirect_pubweb

Go to step 2, download it, run it. Restart, test.


2) Webroot's removal tool:

http://tinyurl.com/87ymasm


However, there's another step you can try to get around it.

Go to start, control panel, click Programs. Select "View installed Updates" on the left. Then look for Internet Explorer 9 in the list. Remove it. Restart the computer.

Download and install it again from here:

http://windows.microsoft.com/en-US/internet-explorer/downloads/ie-9/worldwide-languages


Once again, let me know the results, and most imporantly, which one worked =).


Customer: replied 2 years ago.

Okay, I'll let you know what happens. Cool

 

Love working with someone who knows what they're doing!

 

Later...

Expert:  Justin replied 2 years ago.
Sounds good.
Customer: replied 2 years ago.

I'm having problems reloading IE 9 -- the install got timed out and now it downloads but won't install. Frown Did the Norton and Webroot uninstalls and still got the virus message.

 

Maybe if I if I delete temp files, restart and try the download/reinstall again.

Expert:  Justin replied 2 years ago.
You need to go down your program list, slowly, and remove other antiviruses then.

AVG especially causes this issue.

Reinstalling IE9 isn't going to help. I think everything is directly related here.

Slowly go through the list, anything you are unsure of, just tell me the program name.

Was AVG ever installed on this for example?
Customer: replied 2 years ago.

I did a program search on AVG and got two worksheets (where I was using the formula) and 41 files .... generally with unclear names. There are no other antivirus things that I can see.

 

There's a Roxio that doesn't ring a bell.

 

Are you sure I shouldn't retry loading IE9?

Expert:  Justin replied 2 years ago.
Its happening in Internet Explorer 8 now right?

So it can't be IE9.

Do you have the microsoft malicious removal tool installed.

Webroot spyweeper?

I think this is the stand alone installer of IE9 if you want to try it.

http://www.microsoft.com/download/en/details.aspx?id=23332
Customer: replied 2 years ago.

I couldn't remember testing in ie 8 so I just did and justinmal was downloading just fine until I stopped it. Guess that means it is something in ie 9.

 

I'll go try re-downloading ie 9.

Expert:  Justin replied 2 years ago.
haha guess I should have reenforced the "must test" to see if problem is gone thing.

Yeah, now we need to get IE9 back up, at this point we can assume whatever was going on has been removed and the setting should be overwritten properly.

Remember you have 64-bit IE9 as a backup. Let me know where we're at on the install once you've got it downloaded.
Customer: replied 2 years ago.

It downloaded but didn't install. It was 1/3 way thru install when it stopped before, which is probably what's hanging it up now, but I can't find it anywhere.

 

Tried twice more to download and it downloads but doesn't go to the install step.

 

Sigh.

Expert:  Justin replied 2 years ago.
Could try in safe mode.

Go back to control panel, Programs.

Look for ANY recently installed updates that could be part of the issue. Especially security ones.

Start uninstalling them.


Restart, try the IE9 install again.

If you think its stuck in the temp file and not loaded properly, you can clear your temp files in Internet Explorer via the internt options, under general, click Delete.

Or, use an actual decent internet browser, like Firefox, considering IE9 was more or less the culprit.
Http://www.firefox.com

Login to justanswer via firefox, and then download the internet explorer link again.

http://www.microsoft.com/download/en/details.aspx?id=23332

Through firefox. If THAT doesn't work then tell me and I have something else we can try.

Customer: replied 2 years ago.

Okay, it is now official.

 

I was able to download IE 9 and install it. Testing under IE 8 I could directly download justinmal. Under IE 9, I just got the virus notice.

 

Don't know whether there are any updates, but....

 

What's next .... or are you ready to call it quits for the day? LOL

Expert:  Justin replied 2 years ago.
I'm actually working on a machine for one of my companies that is way worse than yours, so should be up for awhile.

Back to Programs, view installed updates. Start removing updates that are the newest. Do a few at a time to save you time.

Testing between reboots.


Yes annoying, but sometimes this is what it takes.

I'm still pushing for you to use Firefox by the way. But we still need to fix IE.

I would try the reset in IE again, start > all programs . accessories > run.

inetcpl.cpl hit enter.

Advanced tab.

Restore advanced settings, click reset, check the box, click reset again. Test downloads.

I still think its a change in the registry somewhere, from a corrupt virus scan install either triggered by the infections, or a windows update. Both can cause catastrophic issues.

So I realize i',m rambling do the IE reset, then start looking through the updates. Targeting the security ones really, but anything installed in the last week or so, or anything related to IE9 security updates.

You'll also have to restart in between
Customer: replied 2 years ago.

Slave driver! LOL

 

Okay, I'll restore the advanced settings, reboot, test. Then start deleting security updates a date at a time, reboot, test.

 

Microsoft has a heck of a lot of updates! Smile I'll let you know if the testing goes okay at some point.

Expert:  Justin replied 2 years ago.
All good, if I don't respond i'll touch base with you tomorrow.

Keep me posted regardless, very curious to what the cause is. We might have to do a remote tomorrow if the updates don't pan out.
Customer: replied 2 years ago.

Justin, I'm going to bed. No luck so far and it's nearly 11:30pm.... and I've been up since 4:30 this morning. LOL

 

I'll continue in the morning and keep you posted.

 

Pleasant dreams!

Customer: replied 2 years ago.

I'm back into delete, reboot and test mode, but no luck so far this morning.

 

I'll let you know if I run into anything.

Expert:  Justin replied 2 years ago.
I have to run, but I'll be back later (around 4pm EST).

In the meantime, try creating a new user account as a test. STart > control panel > user accounts.

If you don't see user accounts, select view by on the top right, and click small icons.

Add a new user account. Restart, login with that user account, test IE9.


Customer: replied 2 years ago.
Finally deleted all the security updates and no luck. I'm going in to delete, reboot, test the other updates. But I think I'll try your new user approach first. LOL
Customer: replied 2 years ago.

Tried the new user and everything worked the same as it does for me....okay when I go through programs, ie 64 bit; virus when I click on ie icon.

 

I'm going back to deleting. LOL

Expert:  Justin replied 2 years ago.
I'll be available for remote in around two hours
Expert:  Justin replied 2 years ago.
Justanswer has been down for the last day and a half, if you've been trying to reach me. What's the status on your end?
Customer: replied 2 years ago.

Deleted all the updates and still couldn't download justinmal unless I went through Programs, Internet Explorer 64 bit. Frown

 

Freaked when I couldn't get through to you about having no security on my laptop, so spent late last night and early this morning updating Windows.

 

I noticed one thing though when I was actually awake this morning. When I click on Programs, right below internet explorer 64 bit, there's another plain internet explorer. Why would that be?

 

 

Customer: replied 2 years ago.

Btw, when I wasn't getting through clicking on your link, I tried going through the main thingie for just answers and their error message gave an email address and incident number. They replied at about the time of your last reply and explained that they'd been down yesterday and a lot of today.

 

May have given you a breather, but know what that kind of problem can be like! Lots of unhappy people.

Expert:  Justin replied 2 years ago.
Yea its been a mess. I have no time at the moment to do a remote. But we can do one tomorrow.

Any reason you're not using Firefox instead of Internet Explorer? Internet Explorer is overall, an unstable, insecure, and slow browser. I'm not saying I'm not willing to fix it, but in the meantime, I'd prefer you using FF instead of IE64bit.

Customer: replied 2 years ago.

No real reason. I've just always used IE. Let me do a little inquiring and maybe I'll switch.

 

I'll "talk" to you tomorrow.

Expert:  Justin replied 2 years ago.
So long as the site is working, geez!!!
Customer: replied 2 years ago.

'Morning Justin!

 

A little background for you. My first degree was in art but then I became a CPA and got a masters in finance. Worked in public accounting and corporate finance until I rediscovered art. (Yup, one of those people who used to be called right- and left-brained.) Anyway, left a high powered, high stress job in corporate to move to the country and carve and sculpt.

 

The reason I told you that is that I'm at the point where I can't afford to spend much more time on this. I have some house things going on and I have a commission that I need to complete, so.... unless you have something relatively quick for me to try, I'm ready to give up and take my laptop into the nearest city and have the geek squad work on it.

 

What do you think?

Expert:  Justin replied 2 years ago.
Geek squad will wipe your machine (format it using system recovery), they don't address specific issues like this, nor could they since they generally are barely technicians to begin with.

I'm around now though, can take a look remotely.



I will present you with a link to click. Click Run Remote Desktop. It should say “Joining Session” and then you will be prompted to Run/Continue/Allow, select any of them. Your antivirus may pop up and you’ll need to click allow as well. When done correctly, it should say Ready to Connect on the bottom right.

|

If it does not, try the process again (click the link again). And during Joining Session “Click to try another option” and a file download should begin. RUN/OPEN that file. It’s important that you click Allow/continue/run to any Prompts. If I’m NOT connected within a few minutes, return to this page and let me know if there is problems/errors.

|

Click the link below to begin:


http://67.192.95.188:8040/?Session=3a9db3e2-1463-4297-a2eb-1ae17d0da936&SUPPORT=NET
Justin, Network Administrator/Not Limited
Category: Computer
Satisfied Customers: 2551
Experience: Network Specialist Degree, A+/Net+ Certs, 10 years Contract IT/Network Administration
Justin and 14 other Computer Specialists are ready to help you

JustAnswer in the News:

 
 
 
Ask-a-doc Web sites: If you've got a quick question, you can try to get an answer from sites that say they have various specialists on hand to give quick answers... Justanswer.com.
JustAnswer.com...has seen a spike since October in legal questions from readers about layoffs, unemployment and severance.
Web sites like justanswer.com/legal
...leave nothing to chance.
Traffic on JustAnswer rose 14 percent...and had nearly 400,000 page views in 30 days...inquiries related to stress, high blood pressure, drinking and heart pain jumped 33 percent.
Tory Johnson, GMA Workplace Contributor, discusses work-from-home jobs, such as JustAnswer in which verified Experts answer people’s questions.
I will tell you that...the things you have to go through to be an Expert are quite rigorous.
 
 
 

What Customers are Saying:

 
 
 
  • My Expert answered my question promptly and he resolved the issue totally. This is a great service. I am so glad I found it I will definitely use the service again if needed. One Happy Customer New York
< Last | Next >
  • My Expert answered my question promptly and he resolved the issue totally. This is a great service. I am so glad I found it I will definitely use the service again if needed. One Happy Customer New York
  • I am very happy with my very fast response. Eric is very knowledgeable in the subject area. Thank you! RP Austin, TX
  • Hi John, Thank you for your expertise and, more important, for your kindness because they make me, almost, look forward to my next computer problem. After the next problem comes, I'll be delighted to correspond again with you. I'm told that I excel at programing. But system administration has never been one of my talents. So it's great to have an expert to rely on when the computer decides to stump me. God bless, Bill Bill M. Schenectady, New York
  • The Expert answered my Mac question and was patient. He answered in a thorough and timely manner, keeping the response on a level that could understand. Thank you! Frank Canada
  • Wonderful service, prompt, efficient, and accurate. Couldn't have asked for more. I cannot thank you enough for your help. Mary C. Freshfield, Liverpool, UK
  • This expert is wonderful. They truly know what they are talking about, and they actually care about you. They really helped put my nerves at ease. Thank you so much!!!! Alex Los Angeles, CA
  • Thank you for all your help. It is nice to know that this service is here for people like myself, who need answers fast and are not sure who to consult. GP Hesperia, CA
 
 
 

Meet The Experts:

 
 
 
  • Andy

    Computer Consultant

    Satisfied Customers:

    5311
    11yr exp, Comp Engg, Internet expert, Web developer, SEO
< Last | Next >
  • http://ww2.justanswer.com/uploads/EN/Engineer1010/2012-6-9_132423_jaj12a.64x64.jpg Andy's Avatar

    Andy

    Computer Consultant

    Satisfied Customers:

    5311
    11yr exp, Comp Engg, Internet expert, Web developer, SEO
  • http://ww2.justanswer.com/uploads/BA/barrenrock/2011-10-19_215925_JamesJAFinal.64x64.jpg James's Avatar

    James

    Sr. Computer Support Expert

    Satisfied Customers:

    8376
    20 years of experience building, fixing and servicing PCs and operating systems.
  • http://ww2.justanswer.com/uploads/zeyank/2009-09-26_154244_P8110079.png Ryan H.'s Avatar

    Ryan H.

    Computer Support Specialist

    Satisfied Customers:

    1741
    A+ Certified Technician - 10 Years experience working with all types of computer systems.
  • http://ww2.justanswer.com/uploads/JA/jadedangel57/2011-11-8_193134_janenewsm.64x64.jpg Jane Lefler's Avatar

    Jane Lefler

    Sr Prog Analyst / Technician

    Satisfied Customers:

    0
    Computer Programmer / Technician/ Consultant 16+ years
  • http://ww2.justanswer.com/uploads/RO/robmpreston/2013-9-23_233814_mijiFZm.64x64.jpg RPI Solutions's Avatar

    RPI Solutions

    Support Specialist

    Satisfied Customers:

    3476
    5+ Years in IT, BS in Computer Science
  • http://ww2.justanswer.com/uploads/BA/barunrath/2012-7-5_201954_Profilepic2.64x64.jpg B. Rath's Avatar

    B. Rath

    Computer Support Specialist

    Satisfied Customers:

    8671
    Certified Computer/Networking Support Specialist.
  • http://ww2.justanswer.com/uploads/FS/fszcze/2012-6-18_181848_500test.64x64.jpg Frederick S.'s Avatar

    Frederick S.

    Computer Specialist

    Satisfied Customers:

    7240
    Computer technician and founder of a home PC repair company.