Stubborn Garda virus

Gekko · 10-01-2013 7:39am #1

This is on my laptop as of this morning and any help would be very appreciated.

I've tried accessing the Safe Mode with Command Prompt option and then typing explorer.exe and clicking the System Restore option...but no joy, the Garda warning comes up straight away.

Also does so in any other safe mode I tried.

Is there anything else I can try?

Hoping I can get to a stage where I can access the internet and download the necessary tools to remove it...

Tommay · 10-01-2013 7:48am

You could try downloading the Kaspersky rescue disk (If you have another PC spare ofcourse)

https://support.kaspersky.com/4162

Burn it to a CD/DVD and then boot your computer from it (usually F12 as the PC is booting up)

You can then run a scan.

sparrowcar · 10-01-2013 8:03am

Create a bootable USB flash drive from here on a different pc...

http://www.avg.com/ie-en/avg-rescue-cd-download

Stick it into infected pc and follow instructions.

Worked a treat for me recently as I had deleted all my system restore points so was up sh!t creek without a paddle.

degrassinoel · 10-01-2013 12:08pm

got this last night, AVG spotted it but didnt remove it.

temp fix worked for me here

reboot.
F8 on boot to enter safemode
open msconfig and click startup
unselect the russian font name program (you'll know it when you see it, it was at the very end of the list)

I've just updated AVG and running a full scan again to see if i can get rid of it while it's been disabled

mp22 · 10-01-2013 1:09pm

As above,then download and install malwarebytes or superanti spyware, update and run a full scan.

quaalude · 10-01-2013 1:12pm

degrassinoel wrote: »

got this last night, AVG spotted it but didnt remove it.

temp fix worked for me here

reboot.
F8 on boot to enter safemode
open msconfig and click startup
unselect the russian font name program (you'll know it when you see it, it was at the very end of the list)

This worked recently for me also.

Gekko · 10-01-2013 2:13pm

Thanks for all replies. I forgot to say I tried opening msconfig a swell from the C Prompt in safe mode but it wouldn't work.

I'll try and create a bootable USB and then use AVG

sparrowcar · 10-01-2013 2:24pm

Gekko wrote: »

Thanks for all replies. I forgot to say I tried opening msconfig a swell from the C Prompt in safe mode but it wouldn't work.

I'll try and create a bootable USB and then use AVG

The AVG software sets your USB key up as a bootable drive automatically....magic

Gekko · 10-01-2013 8:53pm

Tried the AVG boot from USB...couldn't configure it so it'd connect via wifi and update, ran it anyway but it had an error at 99% scan and didn't complete nor did it find infected files.

May try a Kaspersky one if my patience doesn't run out!

Sparks43 · 11-01-2013 5:32pm

Well im just about to have a crack at this nasty piece of work.

Hope they have a good stock of coffe in the press for me

Gekko · 12-01-2013 12:02am

Sparks43 wrote: »

Well im just about to have a crack at this nasty piece of work.

Hope they have a good stock of coffe in the press for me

Good luck, had no joy so had to take it to local computer repair place.

They couldn't sort it either so they're doing a complete recovery of the laptop :-(

I'll be €80 poorer as a result

Sparks43 · 12-01-2013 7:35pm

Gekko wrote: »

Good luck, had no joy so had to take it to local computer repair place.

They couldn't sort it either so they're doing a complete recovery of the laptop :-(

I'll be €80 poorer as a result

Sorry to hear that man:mad:

Took me 2 hours but i managed to get it off the pc by using mbam in safe mode after stoping all procceses to do with the malware.

Not meaning to be bad but if they couldnt sort the virus out there is no way i would let them do any kind of reinstall.

Really impressive bit of software cant help but tip my cap to the creator.

degrassinoel · 13-01-2013 2:12am

Gekko wrote: »

Good luck, had no joy so had to take it to local computer repair place.

They couldn't sort it either so they're doing a complete recovery of the laptop :-(

I'll be €80 poorer as a result

That's a joke, 80quid? this malware issue can be resolved in less than 5 minutes without a complete recovery or being 80quid lighter in the wallet.

I'd hate to see this as a solution.

areyawell · 13-01-2013 2:23am

Download Rkill.exe in safe. This kills all processes and whatever way its made you can still launch it. this will kill all processes that are not windows processes.

Run Malware anti Malware to get rid of it then. I would rather let my balls in a mouse trap to eat cheese than pay 80 quid to get a virus removed.

You were willing to let windows be reinstalled. Thats a different story.
To reinstall windows is simple and anyone here could have talking you through it. If you were willing to reinstall windows why did you pay 80 euro? Takes two clicks of a mouse and anyone here could have showing you how. Hundreds of videos on youtube about it as well but is completely easy!

Gekko · 13-01-2013 3:28am

As far as I can tell any solution would have needed to be done through the C Prompt screen as it wouldn't let you do anything in safe mode.

Maybe I resorted to the repair centre option too quickly in hindsight.

To make it worse I have lost a lot of MS Outlook emails despite the guy at the repair centre telling me he'd be able to save all my data...

I know I'm at fault for not regularly backing up but this guy should surely have checked with me?!

If anyone knows of a way I might retrieve these any advice would be welcome....have to admit I feel pretty dumb now.

areyawell wrote: »

Download Rkill.exe in safe. This kills all processes and whatever way its made you can still launch it. this will kill all processes that are not windows processes.

Run Malware anti Malware to get rid of it then. I would rather let my balls in a mouse trap to eat cheese than pay 80 quid to get a virus removed.

You were willing to let windows be reinstalled. Thats a different story.
To reinstall windows is simple and anyone here could have talking you through it. If you were willing to reinstall windows why did you pay 80 euro? Takes two clicks of a mouse and anyone here could have showing you how. Hundreds of videos on youtube about it as well but is completely easy!

newmug · 18-01-2013 8:32pm

I have this stupid virus too. But now whenever windows starts, the screen goes white. And whenever I start it in safe mode, it just shuts itself down automatically.

Of the suggestions above, could somebody please give a step-by-step version of what buttons to press and what exactly to click? I'm not tech savvy, and saying something like "open MSconfig" means nothing to me. How do you open MSconfig? I'd really, really appreciate it.

nizarol · 19-01-2013 8:58am

just got rid of this using ye're help so thanks guys. A very clever but nasty bug.
opened in safe mode
in search box type run enter
when run box opens type msconfig enter
when window opens select start tab
scroll down til until you see an option written in Russian (sample, образец)
un-tick this option
open internet and go to malware site identified above in other posts, download, run and 3hrs later when run is complete it is gone

newmug · 20-01-2013 4:21pm

nizarol wrote: »

just got rid of this using ye're help so thanks guys. A very clever but nasty bug.
opened in safe mode
in search box type run enter
when run box opens type msconfig enter
when window opens select start tab
scroll down til until you see an option written in Russian (sample, образец)
un-tick this option
open internet and go to malware site identified above in other posts, download, run and 3hrs later when run is complete it is gone

Right!

1) How do you start a computer in safe mode? The only way I can do it is by taking out the battery and forcing a shutdown, and the the next time I start it, it gives me a safe mode option. But other than that, how do you do it?

2) I managed to start in "safe mode with command prompt", using method above. The old MS Dos type screen came up. On this screen, I typed in "msconfig", and I got a window with various menus, one of which was called "start". I went through it, there are boxes to check and uncheck alright, but no russian writing. I went through all the menus and sub-menus, no russian anywhere.

3) Using another PC, I downloaded that AVL CD rescue in the link above. It took about 8 hours. I put the USB stick into my laptop, booted from it, and another ms dos looking window came up, with various options, eg scan, view scan results etc. I highlighted the top one, "run scan", and pressed enter. It ran a scan, took about an hour, and it found 1 trojan horse. More options were presented, the one I chose was called something like "heal issue". It did its job, and I chose "shutdown system". The I started the laptop up as normal, but no difference. It still goes to a white screen after the screen asking for your password.

What should I do?

RealExpert · 20-01-2013 4:47pm

"Santa" brought my daughter a laptop (Toshiba)this christmas and before dinner on christmas day she got this nasty annoying virus (the garda one)that was looking for money to get rid of it.I know a bit about computers but I couldnt get rid of it actually I couldnt get past the screen that pops up.Now bear in mind this laptop was only in use for probably 10 hours and mcafee security software did not catch it.There were only two sites visited on it one was facebook and the other was a radio communications related site but what i did notice is that on both sites there was a banner selling T-shirts I didnt click the banner but she could have eventhough she said she didnt thats the only place it could have come from I think.
Anyway I done a complete factory reset of the computer with the
HDD Recovery system phew we were all delighted when it started up fine again

mp22 · 20-01-2013 4:49pm

1) press the power on button, then tap F8

2) there probably will not be Russian per say but there will be a start programme with a name made up of numbers and letters (it will not be a word)

3)Superanti spyware or maywarebyts is they only software I know that will help.

If you can get into safe mode try the following http://www.howtogeek.com/howto/windows-vista/enable-the-hidden-administrator-account-on-windows-vista/ restart(in safe mode) and you will have a clean acc to work with.Dont forget to hide the admin acc when you are done.

newmug · 20-01-2013 5:29pm

Finally cracked it!

I did a system restore from a week ago, while in safe mode. Now everything is completely back to normal, and the machine seems way faster! Wayhey! Thanks everybody.

Vulture · 25-01-2013 10:53am

Wow this thing is nasty I have to say I'm impressed.

Old XP machine.
Web page pops up shortly after boot you don't have to click anything.
The web page cannot be escaped with "Ctrl+alt+del" "Alt+f4" "Win+R" or anything like that.
Will not allow me to boot into safe mode with command prompt my computer just hangs and restarts.
Allows me to boot into "safe mode" or "safe mode with networking" but gives me the web page almost straight away still.
I have system restore switched off as my SSD drive is small enough as is.
On boot managed to get up task manager quick and kill "explorer" which stops it dead, first tried the regedit fix I found online. This version does not change the reg like the fix said so no joy.
Then got into msconfig from their with task manager and switched off everything in start tab as switching off just the suspicious ones did nothing.
The Damm thing is still their when I boot up again only now with nothing else to load on boot it gets the web page up so fast I don't have time to get up task manager and kill explorer anymore. :P

Round of applause for this evil thing.
Anyway in temp accomadation right now so no access to reinstall CD and usb cd drive (its a web book). Will get access to them this weekend so wipe reinstall. Can get my files off with bootable Linux key. So I will live but just wanted to point out this thing got nasty with age so some of the old fixes will not work anymore.

Ps got it from a torrent site. Went to site, download torrent, no exe involved and the torrent file was passed straight to bittorrent. (Was a song not porn in case your wondering, who even torrents porn?) Have Microsoft security essentials installed but was not really serious about security on my web book not enough resources on them to be wasting on Anti-virus and Anti-Malware.

Qwerty27 · 25-01-2013 6:50pm

I used this link and te steps set out: http://malwaretips.com/blogs/an-garda-siochana-virus/

Had to restore windows in safe state and then run malware virus checker. Im not very pc savvy but was able to follow all steps and seems to have corrected the issue. As previous poster said, must have come from a torrent, prob need to avoid these for quiet a while now as a result!

Freddy Smelly · 26-01-2013 11:43am

Gekko wrote: »

To make it worse I have lost a lot of MS Outlook emails despite the guy at the repair centre telling me he'd be able to save all my data...

if the repair guys saved your outlook.pst & archive.pst files you can import the emails into your new outlook file.

1. find out where the repair guy saved your old outlook.pst & archive.pst files
2. open outlook and choose import/export
3. select the option that says "import from another file or program"
4. select "personal folder file (.pst)"
5. browse to where the repair guy saved your old outlook.pst file and open.
6. then choose the root folder (mailbox) to import to.

it will start importing all your old emails.

repeat the same steps to import all your archived emails but select "archive.pst" instead of "outlook.pst".

once everything is back restored run the archiver in outlook to move any old emails into a new archive folder.

daveob007 · 26-01-2013 2:53pm

just got rid of mine on win7 home premium by starting in safe mode with networking,updated my avg anti virus and ran full scan,avg found it and killed it.
rkill.exe is brilliant for other types of virus also, try www.bleepingcomputer.com for all fixes went on last year because i got that antivirus program which is a very damaging virus and this site guided me step by step to get rid of it.
got my garda one on a torrent site also so watch out and update any antivirus software you have.

Vulture · 26-01-2013 3:49pm

Had a last shot at it and got rid of it, by doing the following.

CTRL+ALT+Del immediatly on start
End task Explorer
Went into msconfig via task manager and found an item had reticked itself and it looked as follows.
runctf C:\windows\system32\rundll32.exeC:\DOCUME~1\Admin\wgsdgsdgdsgsd.exe,H1N1
Started command prompt from task manager and deleted wgsdgsdgdsgsd.exe

On restart I appear to be free of it but I'm still going to wipe and reinstall. Hope this helps someone.

Sparks43 · 28-01-2013 10:52pm

This might sound like a weird request but is it possible to get a copy of the files/code of the virus without wrecking my comp by vistiting porn/torrent sites unprotected to find it.

Would love to throw it into a virtualbox environment and dissect it

HelpWithIT · 28-01-2013 11:38pm

Newest version of the virus locks down the computer in Safe Mode as well...only way is to make a bootable USB or CD/DVD from either Kaspersky (v good) or AVG site, This virus can come from reputable sites which have been hijacked but I find that once this Garda Virus is cleared I usually find lots of other spyware etc on the infected computers and laptops, if the owner is used to looking up "alternative sites" or using torrents etc then there will always be other spyware etc to be removed. Run command was also disabled in Safe Mode with this new strain of the Virus.. tough one(-;

johnjameson · 01-02-2013 11:15pm

Right so,a relative arrived down earlier with the garda virus on it and some sort of "Fix it" sheet he printed off the internet and said "here fix that" and off he toddled.
Anywhy had a look at it and its the garda virus alright.Had a look at the "fix it" and basically its saying start it up in safe mode and go into registry and remove a series of files associated with the virus.
Now I don't exactely feel too comfortable with going into the registry and messing about with it so I tried the avg fix first.
Made the usb boot,started it up and got this error

smartctl reports some problems with disk
-UTILITIES_SMARTCTL_ERROR

Moving on from the that,within the scan section the hard drive doesn't in the volumes or directory menus only the usb drive does.(although appear in the scan boot sector section)
I should mention its also a company laptop(although its pretty old and on its last legs anyway) but even when I go into the Bios to make a change to the boot order I need a password,so maybe there's some sort of confliction there.

Anyway I haven't tried the msconfig and deleting the russian font yet so I guess thats the next option

ScouseMouse · 01-02-2013 11:34pm

johnjameson wrote: »

Right so,a relative arrived down earlier with the garda virus on it and some sort of "Fix it" sheet he printed off the internet and said "here fix that" and off he toddled.
Anywhy had a look at it and its the garda virus alright.Had a look at the "fix it" and basically its saying start it up in safe mode and go into registry and remove a series of files associated with the virus.
Now I don't exactely feel too comfortable with going into the registry and messing about with it so I tried the avg fix first.
Made the usb boot,started it up and got this error

smartctl reports some problems with disk
-UTILITIES_SMARTCTL_ERROR

Moving on from the that,within the scan section the hard drive doesn't in the volumes or directory menus only the usb drive does.(although appear in the scan boot sector section)
I should mention its also a company laptop(although its pretty old and on its last legs anyway) but even when I go into the Bios to make a change to the boot order I need a password,so maybe there's some sort of confliction there.

Anyway I haven't tried the msconfig and deleting the russian font yet so I guess thats the next option

I cleared a laptop this week. The avg usb rescue worked for me. Then I ran malwarebytes then I found icons and menus all gone.

I did a restore to repair them from a december restore point.

johnjameson · 02-02-2013 1:46pm

superscouse wrote: »

I cleared a laptop this week. The avg usb rescue worked for me. Then I ran malwarebytes then I found icons and menus all gone.

I did a restore to repair them from a december restore point.

Ya I tried the avg rescue disk but when I went to scan it the hard drive didn't show up so I'll have to try 1 of the other options

Stubborn Garda virus

Comments