Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Strife26]

I seemed to have picked up a fun piece of malware. It's manifested itself as Antiviruspro on my bottom right bar thing. It's been popping up three seperate warnings (of differing sizes). Out of desperation, I told it to fix the problem. They directed me to a 'buy the full version page.' After I restarted my laptop, I can no longer get internet. It now directs me to a page can't be dispayed.

I tried turing Norton and the packaged stuff back on, but it hasn't worked. Norton has scanned 0 items after three hours of scanning. Windows Defender found no problems. I tried doing a system restore, but it's giving me a disk failure.

Help please?

[Duke 2.0]

http://www.bleepingcomputer.com/virus-removal/remove-antivirus-pro-2009

 Seriously though, sounds nasty. Seems you need to go registry diving to properly get rid of this crap.

[Strife26]

Okay, I'm going to try that. Let's hope my flash works.

[Strife26]

Well, that didn't work. The anti-malware program won't open, and I couldn't find the listed files with a global search.

[Captain Hat]

Well, you could get a Linux Live CD like Ubuntu or Knoppix, load that up, mount the hard drive, and delete the files the site says are associated with the program.

Spoiler (click to show/hide)

Code: [Select]

c:\Program Files\AntivirusPro2009
c:\Program Files\AntivirusPro2009\AntivirusPro2009.cfg
c:\Program Files\AntivirusPro2009\AntivirusPro2009.exe
c:\Program Files\AntivirusPro2009\AVEngn.dll
c:\Program Files\AntivirusPro2009\htmlayout.dll
c:\Program Files\AntivirusPro2009\pthreadVC2.dll
c:\Program Files\AntivirusPro2009\Uninstall.exe
c:\Program Files\AntivirusPro2009\wscui.cpl
c:\Program Files\AntivirusPro2009\data
c:\Program Files\AntivirusPro2009\data\daily.cvd
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll
c:\Documents and Settings\Bleeping\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Desktop\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\Uninstall.lnk
c:\WINDOWS\dyxad.bat
c:\WINDOWS\gutysolyk.dll
c:\WINDOWS\oheva._dl
c:\WINDOWS\uhuleko.bat
c:\WINDOWS\ulysi.bin
c:\WINDOWS\votadiboz.sys
c:\WINDOWS\xocorepen.lib
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\mehydohahe.scr
c:\WINDOWS\system32\owah.bat
c:\WINDOWS\system32\uquhoti.reg
c:\WINDOWS\system32\zuxeme._dl
c:\Program Files\Common Files\buryleto.dll
c:\Documents and Settings\All Users\Application Data\cyqi.sys
c:\Documents and Settings\All Users\Application Data\gemegiqyno.ban
c:\Documents and Settings\All Users\Application Data\pisijupag.dll
c:\Documents and Settings\All Users\Application Data\pymom.lib
c:\Documents and Settings\All Users\Application Data\wivodexy.reg
c:\Documents and Settings\All Users\Application Data\yzotuxeka.vbs
c:\Documents and Settings\Bleeping\Application Data\ydutufuj.inf
c:\Documents and Settings\Bleeping\Local Settings\Application Data\coziguduca._sy
c:\Documents and Settings\Bleeping\Local Settings\Application Data\fapeka._dl
c:\Documents and Settings\Bleeping\Local Settings\Application Data\gukusozy.sys
c:\Documents and Settings\Bleeping\Local Settings\Application Data\iluqopohaz.ban

[qwertyuiopas]

I also reccomend the linux solution.
Even if you don't install it, keep a disk to boot to in case of viruses and programs that can be classified as worse than some viruses.

[Strife26]

I can't even find the files in question is the funny thing.

[Aqizzar]

You are the Administrator, and you do have View Hidden/System Files turned on right?

[Mr Tk]

Malwarebytes
http://malwarebytes.org/

I used to work in a computer techbay where we would see lots of computer coming through with Anti-virus pro or something similar to it. Malwarebytes got rid of it every time. Give it a go.

[Strife26]

I pulled the Malwarebytes off of Duke's link and flashed it to my laptop, then installed it. When I try to run the program, it gives me an instant:
"Program has stopped working, Windows is attempting to find a solution."
Subsequent tries don't give any response.

[Mr Tk]

Restart the computer and keep on hitting F8 on start up.

When it comes ups and asks you how to do wish to start up your computer, select Safe Mode with networking and then try to run it again.

[qwertyuiopas]

Have you checked msconfig?
It may be possible to disable from there.

[Tormy]

My advice: Don't visit porn/warez sites. 
Advice #2.: Reinstall the OS. Malware/Spyware killers have a tendency to mess up the registry.

[Strife26]

I was searching for military demotivators actually.
The safe mode plan also didn't work.

I'll get around to trying to reinstall the OS.

[Yanlin]

There's your demotivator. Now stop getting infected.

Edit: Fixorered