Comments on: BankerFox.A

By: Luciana

Luciana — Fri, 19 Mar 2010 08:10:14 +0000

Here's detailed Antivirus Soft removal guide.

By: velyn

velyn — Thu, 18 Mar 2010 16:42:18 +0000

Please help. I also can not see any of the listed processes in the registry.

Pressing and holding the Shift Key did not work

The Antivirus Soft icon is in the bottom right of my desktop
I don’t see anything strange under MSCONFIG I tried SAFE Mode and using another logon profile.

AVG is disabled, as is Mcafee Scan because I can not connect to the internet.
I disabled the proxy that was added and I restored the IE 8 default settings for the browser.

I’m not working right now and can’t pay for Spyware Doctor (the free trial download protects from new threats but does not remove any threats that it finds already on your system)
is there any other free option that will fix this without me losing all of my files?

Thanks for your help

By: mallesh nagothi

mallesh nagothi — Wed, 17 Mar 2010 19:25:19 +0000

check your browser’s proxy settings. the virus adds a proxy script

By: Rick

Rick — Mon, 08 Mar 2010 02:43:09 +0000

Spyware Doctor cured it for me.

By: Susan

Susan — Fri, 05 Mar 2010 22:24:38 +0000

I have been having problems with this virus as well. I have problems opening anything because everything was comming up with “infected” errors. Could not open AVG or anything. Here is what I did – I turned it off by cutting the power and forcing it to reboot from scratch. I have multiple profiles on my laptop including a guest one that has no admin rights. When I logged into it – it came up with a message that the virus was trying to run but could not – got the name of it there. Then I logged into my main account and while it was still bringing up start menu stuff, I could open task manager with a right click in the task bar. I found the exe with the same name in the list there and ended the process. Once that was closed, I no longer had any problems with running my virus scans, getting to the internet, or deleting the exe entirely.

By: Linda

Linda — Sun, 28 Feb 2010 15:04:40 +0000

My computer opens up to the Windows and then I can’t click on anything as my mouse is now frozen with the hour glass…..I tried the shift key as soon as it turns on but that doesn’t work either, any other suggestions?

By: Blake

Blake — Sun, 28 Feb 2010 00:43:49 +0000

I just got rid of this virus and nearly pulled my hair out trying to get rid of it. My father-in-law had a fix-it program and i was able to run it. I had to shut the computer down and open the program before the virus booted up. As for the internet problem i ended up resetting my explorer settings and it worked! Tools, options, advanced, and then hit reset. Good luck to anyone who gets this virus! And if any of the creators are watching this post, may you burn in an elevated temperature environment (not sure of the content guidelines on this post lol) Anyway, you get the picture

By: Miranda

Miranda — Thu, 18 Feb 2010 15:14:12 +0000

I did that and it came back. You’re best to eradicate it using Spyware Doctor or following the instructions above.

By: Kylie

Kylie — Thu, 18 Feb 2010 12:51:48 +0000

Thank you everyone… 4hours later i have got removed this horrible virus….

1. Safemode
2. Then I restored my system to an earlier date.

Thank you…

By: Miranda

Miranda — Thu, 18 Feb 2010 09:02:26 +0000

I downloaded Spyware Doctor in the end, though it still took four scans to eradicate everything. Worth the 30 quid I think – I couldn’t find any of the processes or registry entries either.

By: bryan

bryan — Thu, 18 Feb 2010 08:51:40 +0000

well if u can not find processes listed above my advice would be to kill every unknown process and scan your pc with antispyware program

By: bryan

bryan — Thu, 18 Feb 2010 08:44:16 +0000

You must have deleted someting. There might be some problems with your tcp/ip layer, try to download this tool: http://www.cexx.org/lspfix.zip check and fix it.

By: Paul

Paul — Wed, 17 Feb 2010 20:22:22 +0000

I have managed to do stage 1 but cannot find any of the exe files in the processes, cannot find any of the named files in the registry entry, cannot find the spyprotect in the programs files, and the virus is till merrily pissing me off….

By: Paul

Paul — Wed, 17 Feb 2010 19:05:05 +0000

Can someone help me, when i try to open the comp in safe mode and chhose to open in safe mode it goes straight back to safe mode screen without the comp starting up and just keeps looping back asking me to start in windows normal mode.

By: Don

Don — Wed, 17 Feb 2010 00:29:51 +0000

Just helping a friend with bankerfox.a and win32/nuquel.e spyware/virus. As soon as the computer booted up, I hit cntrl+alt+del then brought up the task manager. This prevented the virus from blocking the task manager. then I went to the process tab and once the virus reared its ugly head, systematically began to end-process that I figure shouldn’t be the problem, then address the ones that looked suspicious.

Alot of programs, like windowslive chat, get added to your start-up programs and begin running automatically when you boot up (this also slows your computer) you can control what starts up auto and what has a pause or waits for your command.

In the process I found powrsftav.exe, and when I shut it down the attack stopped. I searched his computer (remember to advance search and select hidden and non-indexed files since it is hidden) and came across two files with pwrsftrav name and deleted both…end of problem.

By: Miranda

Miranda — Tue, 16 Feb 2010 23:35:59 +0000

My virus now looks like it’s gone, and I picked it up today, in its most recent incarnation.
What I did was started in safe mode with networking, then when it prompted me before launching I ran system restore.

AVG’s just gone through the registry and nothing. Malwarebytes has found nothing… should I be worried?

By: Jerome

Jerome — Sun, 14 Feb 2010 14:08:12 +0000

Shellie, this might not help that much, but in my case, if I reboot in “Windows Safe mode with Networking”, the virus no longer bugs me and I can go download things on the Internet with Firefox. Not that I identified yet what to download though…

By: Jerome

Jerome — Sun, 14 Feb 2010 14:05:54 +0000

Similar problem. My wife’s laptop is now host of this thing which keeps claiming that processes are infected any time a process is started, advertising a fake security Web site if say yes to activate more security, and popping up a porn Web site every now and then (to the great amusement of my teenagers!).

Can’t find any of the suggested files, processes or registry entries. Norton 360 was mostly disabled. I (painfully) succeeded to re-install it from the Windows safe mode, and update it to the latest signatures, and run a full scan. No luck. Malwarebytes’ Anti-Malware doesn’t seem to find anything either.

Quite clearly, this virus recently morphed to a new form, not known by Norton or Malwarebytes. I just don’t know how to approach the problem… Ideas would be very welcome.

By: Jess

Jess — Sun, 14 Feb 2010 05:24:03 +0000

I had the virus, ran the program, and successfully removed the virus. Only problem is that I can’t log on to the internet now when not running in normal mode! I must have deleted something by accident! Can anyone advise me on how to remedy this problem?!?! Thanks for all the help!

By: Ellie

Ellie — Thu, 11 Feb 2010 18:00:22 +0000

I got it yesterday. I was on Facebook commenting on my OWN picture and was redirected to the site that dumped Antivirus Soft on my laptop. I’m fortunate to have a working desktop to find the cure, but I’m having trouble starting my laptop in safe mode. I tried F8, F12 and Ctrl + F11. Nothing works. I have a Dell.

I was able to get to my Task Manager and also do not have any of those programs running. This sucks.

By: Dennis Grecco

Dennis Grecco — Thu, 11 Feb 2010 02:40:59 +0000

10 Feb 10. I just got it today. It came up as Antivirus soft. Downloaded PC Tools Spyware Doctor and am on my third pass and it is still finding infected files.

By: Susan

Susan — Mon, 08 Feb 2010 20:43:05 +0000

I just got it today. It came up as Antivirus soft and also immediately froze everything so I could not access task manager, spybot, my antivirus software, etc. Then showed the same message as shown at the top of the page, I rebooted but was not quick enough to put it in safe mode and can now access all of these things. And my internet. None of the programs listed above are in my registry. I’m afraid it is now sleeping on my computer.. I read on another forum the virus is a keylogger that access passwords and credit card info. Is this true, does anyone know more information on this virus? The forum also said system restore is not effective, the only thing that works properly is a reformat. Since my computer is no longer showing signs of a malware attack, I don’t know what to think. I don’t want to assume it’s safe, and next thing I know my identity is stolen.

By: Shellie

Shellie — Sat, 06 Feb 2010 12:58:01 +0000

I have this virus on my laptop. I cannot get access to the inernet to download anything to remove the virus. Every time I try to get on the internet, it freezes on the page that prompts me to buy the antivirus software. Then, a porn sites and viagra sites pop up. How can I get on the internet to download the things I need to remove this mess?????? Please help!!

By: Adam

Adam — Fri, 05 Feb 2010 22:23:35 +0000

I am also having the same problem. You guys say its this spyware 2009 program but i am getting a new program name which is Antivirus Soft.

By: Joe

Joe — Fri, 05 Feb 2010 19:43:48 +0000

This may seem too easy. I’m no PC guru but I just selected the System Restore prompt after rebooting in Safe Mode and selected a restore point from a few days back when my PC wasn’t infected and that fixed my problem. Hope it’s a permanent fix.

By: steven

steven — Thu, 04 Feb 2010 18:44:19 +0000

i have this virus. I cannot find anyof the files listed above. and ive tried about every spyware removal tool there is out there. is it possible that i have a new form of the virus. I just got it yesterday

By: Chris

Chris — Tue, 02 Feb 2010 02:37:12 +0000

None of the processes mentioned show up in the process library on my computer. Even when this malware’s icon shows up on my task bar there are no processes that match those given in the above list.

By: Meg

Meg — Mon, 01 Feb 2010 19:24:43 +0000

Thank you!!

By: Luciana

Luciana — Mon, 01 Feb 2010 08:51:00 +0000

There is no comments section in Task Manager. Names of processes loaded by this malware are listed on this page BankerFox.A removal. Scroll down till you see "BankerFox.A manual removal instructions", you will find tutorial there on how to delete all the things related to this malware.

By: Rick

Rick — Sun, 31 Jan 2010 12:05:40 +0000

What do I do if I don’t have a comments section in Task Manager? What else can I do to get rid of this virus.

By: Eileen

Eileen — Sat, 30 Jan 2010 07:49:28 +0000

Evidently they are still going on with this after these solutions. The version of the bug I Have blocks any attempt to open the task manager via any route I know as well as most programs on my PC and all control panel functions. I haven’t tried rebooting to safe mode. Afraid I’ll never get my machine back up if I shut it down.

This time the bogus software is called Antivirus soft, but it’s the same thing, even has the same illiterate typo in the warning window.

can someone direct me to instructions on removing the latest strain? Thanks

By: Jimi D

Jimi D — Fri, 29 Jan 2010 21:24:19 +0000

I just followed the advice to first open in safe mode I you can’t do that open and get to the task manager immediatly the end process sysguard or anything like it found about 4 or 5 you can also end process tree instead after that the pop ups stopped I the went to my Internet connections to see why I couldn’t get to the Internet and found that something switch me to proxy server which is wrong for me so I changed that then went to my antivirus updated that the went to startup from msconfig found and disabled anything I didn’t recognize or that had sysguard in it then ran my antivirus “Webroot essentials great stuff” shut down and reboot so far no problems.

By: Dayna

Dayna — Fri, 29 Jan 2010 06:26:52 +0000

I am stuck in the same position as Mandy right now and Need answers asap. This laptop has my school stuff on it so i need to get this virus off!!

By: Mandy

Mandy — Tue, 26 Jan 2010 20:24:52 +0000

we got this virus. Norton finally found some threats and we downloaded another spyware program. We still can not access the internet. It says a firwall is blocking the website. We ran both antivirus/spyware programs in safe mode and nothing was detected. Is this virus still hiding somewhere? Is there something wrong with internet explorer? We tried all the do it yourself removal.

By: zelda

zelda — Fri, 22 Jan 2010 04:31:11 +0000

Thank you for your post. To make a long story short, the shift key procedure worked! It did not let the virus run, and immediately enabled my Norton Utilities to do their job and obliterate it all together! Prior to this approach, the virus which had as they call it, “entered through the back door”, got by the Norton, and hid itself well onto our system. It had blocked all functions. Could not get to task manager, would not allow access to Antimalware/Malwarebytes, no internet access etc. In safemode, I was able to run virus software but it did not remove all of the virus. My last resort was the shift key. Only set back was that settings were changed and had to work with tech support to reestablish modem configurations ad IP address/default gateways. System is back and operating after a short setback.

By: Tony

Tony — Sat, 16 Jan 2010 09:53:44 +0000

Top instructions, sorted the job out. well done.

By: carole

carole — Wed, 13 Jan 2010 23:03:34 +0000

Thank you, thank you, thank you. I have been trying to get rid of this for 3 days. Your site’s links and advice was the only one that worked.

By: Luciana

Luciana — Mon, 04 Jan 2010 08:38:24 +0000

Press Ctrl+Alt+Delete buttons simultaneously or right-click the Task bar and choose “Task Manager” option.

By: Luciana

Luciana — Mon, 04 Jan 2010 08:32:26 +0000

The malicious processes are listed above the comments section.

By: Norma

Norma — Sat, 02 Jan 2010 21:57:30 +0000

How do you trigger the task manager at startup? I really need to know this so that I can get in and delete this virus. It is a pain in the butt. It won’t let me open the Add/Remove program and won’t let me open the Internet Options to block certain websites.

Please help.

By: jo

jo — Fri, 01 Jan 2010 16:38:51 +0000

how do I know which process on the task manager to end??

By: steve

steve — Tue, 22 Dec 2009 17:29:21 +0000

i found that if you quickly access task manager on windows startup you can access it and end the wfrrsysguard.exe process from task manager. This allowed me to run spybot search and destroy which deleted most of the files. Then had to access msconfig and remove wfrrsysguard and a couple of other proccesses from starting when windows does. This appears tio have stopped the spyware from loading although im pretty sure there are probably a couple of infected files left on the computer but the processes have stopped running so it is no longer causing problems. Hope this helps

By: Luciana

Luciana — Mon, 21 Dec 2009 08:43:31 +0000

You can delete Spyware Protect 2009 manually so your browser won't get redirected and you won't receive BankerFox.A pop-up. Click here for SpywareProtect 2009 removal instructions.

By: Sean

Sean — Sun, 20 Dec 2009 08:35:46 +0000

are win32nuquel.e and bankerfox.a tied with sysguard???? if so, then i deleted sysguard (abfssysyguard for me, it sometimes hides itself) and all the pop-ups disappeared.

By: Clarissa

Clarissa — Fri, 18 Dec 2009 19:05:19 +0000

I’ve got the exact same problem, it wont let me open anything, everytime I click on an icon, it doesnt open and I can’t go on any websites but it randomy opens porn sites. Please someone help!

By: Mason

Mason — Tue, 15 Dec 2009 01:00:23 +0000

My computer got this virus some how. And it won’t let me open task manager or go into the registry editor or even let me open my spyware program. I’ve tried downloading two other spyware programs and it still won’t let me open them. I get a message saying the .exe file is infected. Any ideas??

By: dele

dele — Mon, 30 Nov 2009 23:15:13 +0000

That virus is a stinker. The way I removed it was to hold down the shift key immediately I saw the window logo, this will stop the bankerfox.a etc from runing. I then went into task manager and stoped all the sewrvices that I did not recognize. One of them or more relates to the virus. You then can go into your registry and search for bankerfox.a and nqel or something like that and deleted them.

By: Shauna

Shauna — Mon, 16 Nov 2009 13:45:03 +0000

My computer will not allow me to run removal tool for banker fox and will not allow me to switch the compuetr on in safe mode-what do I need to do?????

By: Luciana

Luciana — Mon, 05 Oct 2009 07:22:04 +0000

Restart your computer and keep clicking F8 key while the PC is still booting up. You’ll get to the menu with the option to boot into safe mode.

By: joannie

joannie — Sat, 03 Oct 2009 14:29:16 +0000

How do i run it in safe mode?