Anybody had the Personal Security virus?

[Perd Hapley]

I'm trying to clear this thing off of someone's computer.  The first fix that I found didn't work at all, but I found instructions for using Personal Security's own uninstall function.  This seems to have worked very well, but I guess I just don't trust a virus that uninstalls itself. 

Anybody got any info?

[lupinus]

nuke it from orbit and reinstall the OS 

[Perd Hapley]

I hate it when people say that.     No, really, I don't learn anything that way, so I'm trying to avoid it.  I'm running Malwarebytes right now, to see if it turns up anything.   

[geronimotwo]

malwarebytes did a good job from safemode, on the "antivirus live" that i just dealt with.

[lupinus]

I figured I'd get that answer out of the way.

Not sure if it's the same one but for me I had to download several programs on another computer, burn to disk, and install on my computer. IIRC it was malwarebytes, super anti spyware, adaware, and spybot. Each one found different parts and only after all could I finally get AVG to open and run.

Took three or so rounds of all of them IIRC before every bit was removed.

[Perd Hapley]

I'm scanning with MalwareBytes right now, and it's found two items.  Don't know if those are PS-related, yet. 

PS's startup file is gone, and it doesn't appear in the registry.  According to one website I've looked at, it would have been at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | PSecurity.  Don't see it. 

[RevDisk]

I'm scanning with MalwareBytes right now, and it's found two items.  Don't know if those are PS-related, yet. 

PS's startup file is gone, and it doesn't appear in the registry.  According to one website I've looked at, it would have been at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | PSecurity.  Don't see it. 

Download AutoRuns from Microsoft.   Look through the list manually and see what you can find. 

[French G.]

It must be a tard virus, I removed it once with no help and I suck. I just looked through task manager for anything that was running that wasn't there before, googled any un-known programs, deleted any components of the stupid virus and went on with life.

[Perd Hapley]

Initially, PS would not even allow me to open task manager or much of anything else.  Here's how I got it to quit making a nuisance of itself.  Found this here:  http://www.precisesecurity.com/rogue/personal-security/

We sent a message to the company that created Personal Security on the “customer service” link that we would track them down and sue them for attacking our kids computer. They emailed this solution and it worked in less than one minute. We still downloaded and ran an antispyware program afterwards to make sure nothing remained. This was their response which worked:

“Dear customer,

Thank you for contacting Customer Support Center.
Please follow my instructions to uninstall the program:
Paste the following string to Windows Explorer address bar and execute it (Press Enter key):
C:\Program Files\Common Files\PSecurityUninstall\Uninstall

or

1. Open My computer, choose Disk C;
2. Find Program Files=>Common Files=>PSecurityUninstall=>Uninstall
3. Run the file Uninstall.lnk

After that our product will be removed.Sometimes it takes more than one try to remove the product due to temporary technical difficulties, so please try to do it several times.
If you have any questions concerning our software, please contact our Customer Support Service.

With best wishes,

Customer Support Team

I don't know about you, but I didn't know virus-making tools were in the habit of providing handy instructions for easily and simply removing their product.  As soon as I uninstalled it, everything seemed back to normal.  Of course, I'm still trying to make sure everything is gone.

[AJ Dual]

Generally speaking, I've not come across the infection or malware that a combination of Malwarebytes, Combofix, Vundofix, and then a regular scan with any reputable virus scanner, AVG, Kapersky, TrendMicro, Norton etc.

I had a bad one just the other night, and it actually deleted Malwarebytes, but Combofix nuked it, and then Malwarebytes could be reinstalled and it found a few remaining registry entries etc.

[RocketMan]

You really ought to be using a tool like RootRepeal to determine if the nasty dropped a rootkit on the system.  Rootkits are all too commonly included in rogues these days.  I had a bad one last week that took some real digging to get out.
I finally managed to clean the system and gave it back to the owner with strongly worded advice that they purchase a quality full-time malware protection package.  I provided names of several good apps for them to choose from.
The owner delayed the purchase (ignored the advice, really), went online and accessed their emails, and promptly re-infected the system.  It did not last an hour past delivery.      

[280plus]

PC tools spyware doctor has worked quite well for me. I pay the annual $39.95 for the version I have. The 2010 upgrade seems to be a bit bloaty though, slowing things down a bit. The 2009 version was faster.

[sanman]

For what it's worth, I've been using Panda on 2 laptops and a desktop (XP Pro then Vista Ultimate) for a couple of years after advice from a friend. It wacked an Antivirus 2009 attempt on my wife's system and they all stay clean. As always, results may vary.

I'm considering the built in protection with Windows 7 on another desktop yet to be deployed. Haven't played with it yet, though.

[Perd Hapley]

You really ought to be using a tool like RootRepeal to determine if the nasty dropped a rootkit on the system.  Rootkits are all too commonly included in rogues these days. 

I used RootRepeal, and I don't see anything that looks like Personal Security.  I've run a few different scans, deleted some files and registry keys manually, rebooted a number of times, and I've been using this thing for hours with none of the previous symptoms.  I'm starting to think the thing has been beaten. 

[RocketMan]

Good work, fisty.  Exercise it a bit, use some of the apps like Internet Exploder and others, keep and eye on it and see if anything pops up again.  It's probably okay.

[Perd Hapley]

In case anybody else has this problem:

Go to My Computer, C drive, Program Files, Common Files, PSecurityUninstall, Uninstall.  

If it won't let you access those files, go to Run, on your Start Menu, and enter C:\Program Files\Common Files\PSecurity Uninstall\Uninstall   

For all intents and purposes, this seems to get rid of it.  I would still run MalwareBytes, and check for other files and registry entries that it leaves behind.  There are a couple of websites that will tell you where to look; just Google it.  

[RocketMan]

Trend Micro's "Hijack This" does a good job of pointing out nasty bits involved in an infection.  It even ferrets out remaining traces after the main infection has been removed.  Give that one a try, fistful.  Use it carefully, though.  You can hose the system further if you delete the wrong things.