Personal Security

currently, the only removal process that I have been able to sucessfully use involve putting the infected hard disk drive into a clean computer and deleting the infected folder.

However, if you can get into Safe Mode (restart your computer and immediately begin tapping the F8 key at the top of your keyboard. This will bring up the Windows Startup Menu. Select Safe Mode using your arrow keys and then press Enter), you can try deleting the infected folder in c:\documents and settings\all users\application data\<infected folder name> where infected folder name is usually equal to a numbered folder like this 65345637. The name could be anything though, so if you don't see a folder like I am describing, post a list of the folders that you do see so that I can evaluate them.

If you can delete this folder then you should be able to run programs again and continue your removal process by running Malwarebytes, SuperAntiSpyware, CCleaner, ATF Cleaner, and a full updated Antivirus scan.

First things first though! Can you get into Safe Mode successfully? Some variants of this family of viruses disable Safe mode.

thanks for your help, i have tried restarting the computer in safe mode but that did not seem to work.
I have had a look at the folders in the application data and there are two numbered files at the top but it says they have not been modified since April and October 2009

The names are:

{755AC846-7372-4AC8-8550-C52491DAA8BD}
{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

Do any of the folders in the Appliaction Data have a file whose icon is a shield. ie: A silver shield or some other color?

While your in Safe mode, also check out the C:\Program Files folder to see if you have a sub-folder named PSecurity. If so, delete it.

Here are a list of other known folders that this virus creates. If you find any of these folders, delete them:

c:\Program Files\PSecurity\
c:\Program Files\PSecurity\psecurity.exe
C:\Program Files\PersonalSec\
C:\Program Files\PersonalSec\psecurity.exe
C:\program files\PersSecurity\
C:\program files\PersSecurity\psecurity.exe
C:\program files\PersSecurity\personalsecurity.exe
C:\program files\PersSecurity\system.dat
C:\Program Files\PersonSecurity\
C:\Program Files\PersonSecurity\psecurity.exe
c:\Program Files\Common Files\PSecurityUninstall\
c:\Program Files\Common Files\PSecurityUninstall\Uninstall.lnk
c:\WINDOWS\system32\win32extension.dll
c:\Documents and Settings\All Users\Start Menu\PSecurity
c:\Documents and Settings\All Users\Start Menu\PSecurity\Computer Scan.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Help.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Personal Security.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Registration.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Security Center.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Settings.lnk
c:\Documents and Settings\All Users\Start Menu\PSecurity\Update.lnk
%UserProfile%\Application Data\Microsoft
\Internet Explorer\Quick Launch\PSecurity.lnk
%UserProfile%\Desktop\Personal Security.lnk


After deleting any of these that you find, you can restart using the F8 key and enter into Safe Mode with Networking Support this time and use your web browser to download MalWareBytes from http://www.malwarebytes.org/

Install this download, update it, and run a full scan.

When this is accomplished, restart in Normal mode and scan again.

You may or may not find everything in order at this point. If not, we may have to continue fixing what the virus broke.

Post your results!

Revove from the list of quoted messages

The problem is I can't get the computer to go into safe mode when restarting at all, it just won't let me do it.

It's so frustrating, I can't download any kind of software which can help me remove the programme and I can't open hardly any files on my computer either.

Do you have a second computer or a friend with a computer that will help you?

Also, I should ask if you have any other web browser installed other than Internet Explorer? Often times Firefox, Opera, or some other browser will still work because they are not targetted.

Do you have another hard disk drive we could work with?

[#0005ff]You have to fool this thing into allowing you to download and install the programmes it knows can destroy it. Start in Normal Mode and it starts covering the screen with rubbish trying to con you into buying it. Ignore them, even if they pretend to scan. Right click a vacant part of the Taskbar and click up Task Manager - alternative press Control, Shift and Escape together. Click the Processes tab and find the file that's causing the annoyance and click on End Process Tree. Go Start>Run and type in msconfig. Click the StartUp tab and untick everything except your anti-virus and firewall programmes. Click Apply and OK then let the system restart. When it has, tick "Don't show this message again" and press Enter.

You should now be able to work normally so go to and download MalwareBytes. Install it and let it update and restart itself. If it won't install, find the downloaded folder and rename the file MBAM.exe - call it Fred or Colin - your choice. Click on the renamed exe and that should start thye install process.

Run the Quick Scan and let it fix whatever it finds. Restart the computer and run the Full Scan and do the same. After that restart, go back in to MBAM and click the Logs tab. Post both back here using copy and paste so we can see what you got rid of. There will be other things to do.


[/#000ff]