Have you ever had one of those fake antivirus things pop up on your computer? You know the type, "50,000 infections found! Click here to remove! *click* Pay $$$ to remove or you have viruses!!1". They're very convincing; usually they look like legitimate programs and/or parts of Windows. They prey on novice PC users who jump at the word 'virus' and think they have done something wrong.
I recently had the misfortune to meet one called XP Anti-Virus 2011 (not my computer that was infected, I was just tasked with fixing this particular one). This virus - and yes, I am calling it a virus even though it technically isn't one - is the nastiest rogue software I have seen yet, though I'm sure it's not the only one to run as it does. It's not new, despite the name - it's been around for years under various different names, mainly comprising of your version of Windows and the current year. So under Windows XP, you'd get XP Anti-Virus 2011 and under Vista you'd get Vista Anti-Virus 2011...etc.
Why is this particular one clever? Well, as I said, it's probably not just this one, but what this program does is to change how .exe files are run on your computer. On Windows, .exe files are normally programs; nearly all executable files will have that extension. Mr Nasty Virus here reroutes all .exe files to run through itself - and it'll block any it doesn't like. Those it doesn't like include almost all legitimate antivirus/antispyware scanners and certain web browsers as well - it didn't seem to stop Chrome but it put a stop to Internet Explorer in any case and kept reopening itself informing me that the computer had too many viruses and I must click here to register and remove threats. That of course makes removing this piece of rubbish a right pain since, well, it doesn't let you. :P Of course, it did everything else these fake programs do - nice threatening messages, cloned the Windows Security Center but plonked itself there instead, typical antivirus program look... All very lovely.
I removed it by following a mixture of guides online - this guide is one of many that explains the basic steps (note the insertion of the license key in those steps - once you do this the program will act as if it removes the viruses and/or itself. Ha - I restarted and it came back up an hour later saying my registration needed confirming and I still had threats). Once you've got rid of it, make sure to update your real antivirus/antispyware protection and run a full scan to make sure it really has gone. A lot of those guides keep trying to push a download of SpywareDoctor (normally labelled as the "remover" for the viruses)... I've never found that program anything more than bloat, personally - I removed the items manually then ran MalwareBytes' Anti-Malware on a full scan to make sure all traces had gone.
How do you protect yourself from getting fake antivirus software on your computer? Here are a few tips:
← Previous entry: My top 5 Android apps | Next entry: All change →
I got hit with three of these in five days about two weeks ago. :| Avast was being a jerk and not working properly, which I didn't notice because I'm very unobservant. The first one took the longest because I had to go into safe mode with networking and download Malwarebytes and then do a full scan just to be on the safe side, so that took like 2 hours. I killed the other two in about fifteen minutes each using the quick scan function, but it's still really annoying. Luckily I haven't had anything like that happen since then *knock on wood*, but I've been doing regular scans with Malwarebytes and making sure Avast is operational and updated at all times.
I can definitely see someone falling for this kind of virus. They look pretty legit, and the ones I had used perfectly fine English, so I could understand someone who isn't totally computer literate getting screwed over by one.
I haven't personally gotten any of these types of viruses (lucky me!) but I had to remove one from my brother's PC the other day. For some reason, Malwarebytes (my first instinct too) wasn't picking up on the virus, even after I manually updated the database? In the end, my solution was to get SUPERAntiSpyware's portable scanner on a flash drive and that did the trick.
Do you happen to know if the virus you mentioned has anything to do with the infamous Google redirect problem on Windows 7?
I had that same virus before. I mistook it for my anti-virus software, clicked on it, then realized it was a virus. Fortunately, I was able to get rid of it. I had those sneaky viruses!