anti-virus 2009

[mikeh]

Anti-virus 2009 is is a continuation of anti-virus 2008 that is a virus itself. Our office got hit with the 2008 version and it hammered us for awhile. We got rid of it, fortunately. Now my wifes computer got infected with a program that keeps trying to get her to download and install anti-virus 2009. It installed a decktop shortcut to a porn site (i removed it as soon as i noticed it) It has killed microsofts system restore, it blocks access to websites like microsofts download sites, McAfees download site, etc. When you google words that indicate you are trying to find ways to get rid of it, it throws up tons of sites in front of you to block you and now it has killed her computer. It boots up to the desktop but never fully loads to get things going. (Give me the name of the individual that designed it and i'll bury them upside down in a pile of #@%*) It is one bad virus or rogue program or whatever.

My 1st question, has anyone else heard of this and found ways to deal with it?
2nd question. How does one repair windows XP? The help says just go to the installation and choose R for repair. I don't get any such option when i insert the XP disk in safe mode. All i get is installion (with no R option) and upgrade that doesn't work.
Thanks.
mh

[RErender]

Repair will not likely fix it, a fresh install is always best. What browser are you using on her computer? IE?

I believe you need to boot from the xp disk to get the option

[Morbid Angel]

it sounds pretty hopeless to me. Repair will most likely not work, if you had installed updates to winxp after the fact, it may screw things up. Not sure though. I think best bet is back up and reinstall with clean slate.

[stevesideas]

Have you tried an online virus scanner. Are you running any toolbars in your browser. Sometimes viruses operate through those. It would be wise to uninstall any google tools bars (or similar first). Download a trojan sweep programme.

Have you tried ctrl/alt/delte and seeing what processes shouldnt be running ?

Links to some instructions:

http://www.removal-instructions.com/...virus2009.html

http://www.2-spyware.com/remove-antivirus-2009.html

Good luck

[dlparisi]

Evidently Microsofts Malicious software removal tool now removes AV2009... http://www.infopackets.com/news/security/2008/20081231_400000_pcs_infected_with_fake_antivirus_2 009_software_says_microsoft.htm

I know this doesn't help right now but might help in the future...

[mikeh]

found the malwarebytes anti-malware (free) was still on my computer at work, downloaded the most recent version, brought it home, used it in safe mode and got rid of all infected files (supposedly) but what it did was to delete all points of restore to return the system to it's previous configuration. Very bad. Her computer boots up saometimes but the trojan virus is still there and so i think my next step is to take the advice on the forum of getting rid of the google toolbar. I've already gotten rid of the yahoo toolbar. Her computer still usually fails to fully boot. I've been to the sites for getting rid of anti-virus 2009 and as far as i can tell, it's not on her computer. Some other thing is there.
mh

[stef.thomas]

This is always a good place to go for help. The guys on this forum will take you through it step by step to remove any remaining problems free of charge.

http://www.geekstogo.com/

[rmejia]

I had a similar problem a couple of days ago. The secretary saw the fake virus warnings and downloaded and installed one of these fake anti virus programs. I don't remember which one exactly, it might have been this xp antivirus. I googled how to remove the program and followed the instructions on some site to delete all the files, hidden files, and windows registry information. After that I ran the Malwarebytes' Anti-Malware. The computer seems to be free of the virus now. It would always show up at startup, and was afecting IE (I used another computer to google solutions and printed them out). No visible problems have been detected after deleting the files for the program.

http://www.bleepingcomputer.com/malw...irus-2008-2009

[vlado]

Isn't Windows Defender supposed to guard against and clean things like these?

Best regards,
Vlado

[glyph]

my wife's laptop got similarly infected with a rootkit (thats probably what you have) a while ago - all in all it made more sense to do a clean reinstall - and at the end I was 100% certain the bug was gone

Windows repair at re-install is known to be an over-optimistic concept..

going through the other options can take longer and at the end you wonder if the bug is just hibernating like the Alien ready to erupt at any time

[mikeh]

Isn't Windows Defender supposed to guard against and clean things like these?

Best regards,
Vlado

Windows defender might work but the virus blocks access to it. I can't get the req'd windows authentification that allows download/install. Unfortunately one can't just download it to another compter and then carry it to the infected computer.
mh

[mikeh]

my wife's laptop got similarly infected with a rootkit (thats probably what you have) a while ago - all in all it made more sense to do a clean reinstall - and at the end I was 100% certain the bug was gone

Windows repair at re-install is known to be an over-optimistic concept..

going through the other options can take longer and at the end you wonder if the bug is just hibernating like the Alien ready to erupt at any time

I've done format/reinstall before and have always hated it. For me it's a last resort. I'm going to the forums for this stuff and am going to try them and the additional software available.
mh

[pskdude]

virus

i myself had a problem several weeks ago, I spent hours and hours trying to get a keylogger off my system after many attpemts with scans ( i did get close with the malware bytes free version from cnet. however at the end i ended up reformating. It spent a couple of days in hernation and i staarted getting weird hits from weird ip's anyways my recomendation back-up your SH** and REFORMAT !!!!!!! =) sorry for the hostility but after a week of frustrations this is what it resorted to.

Anyways Good Luck. and again REFORMAT REFORMAT REFORMAT !

= P

/format c:

[mikeh]

our IT guy suggested a method of manually tracking the trojen file down. I've been able to disable it and now my wifes computer no longer boots in only safe mode. The next task is to find it through a process of elimination and delete it for good. If that fails then its reintsall OS/format. At least websites are no longer blocked and the pop-ups have stopped.
mh

[stevesideas]

I had a trojan on my computer last year. The only way I could stop it coming back was to delete the google toolbar, uninstall my virus programme (avast) and download a trojan search utility. I also manually stopped the virus process and deleted the files manually. I found out I had to delete avast and the google toolbar by mistake. It seems that the virus actually uses these programmes to replicate itself. Might be worth a try getting rid of any toolbars installed via internet explorer.

I now only download messages etc on my laptop. It is all part of the same network but if anything dodgy happens its only my laptop that gets affected.