Slashdot Mirror
Fake Antivirus Overwhelming Scanners
ChiefMonkeyGrinder writes "Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008."
It makes sence to make a virus like this. My buddy got one. It said you have a virus pay us $X for full version of Anti-Virus program to remove it. It was a real pain to remove as I remember.
Adverts for these things get into legitimate sites all the time through things like adwords, even though they're normally taken off quite sharpish, they're still there. They still cause problems and numpties do click on them. The old IBK error keeps appearing. As long as people aren't educated as to how this all works the problem will remain huge.
The problem with Anti-virus is that every few years a new guy appears on the block. First it was Norton, then Mcafee, then AVG, Kaspersky, and now whatever AV's the in-thing to use. There are new viruses out there all the time too, and if there's one thing that normal people are aware of it's that there are alot of viruses out there, and that your AV doesn't give 100% protection, so when something pops up saying "You're infected! Our AV will cure it!" they're likely to believe that their current AV is defective, because clearly this one spotted it, they download it and BAM! world of trouble.
It's depressing sometimes, but gladly, I've not had to remove it from any PCs in a while, whenever I do I recommend they replace their browser with Firefox and Adblock plus (Not noscript, I did that once and I got bollocked for that a bit because 'using the web was too hard as he had to press buttons every site he went on', the guy was a real pleb but nevermind) - and ABP stopped all the ads, and thus, stopped them downloading and installing that shite.
It pays to be obvious, especially if you have a reputation for being subtle.
Note to clueless mods, Antivirus 2009 is one of these fake antiviruses, mod them funny, not interesting....
Taxation is legalized theft, no more, no less.
I've been losing this battle with the staff where I work; they just can't seem to understand that it is itself spyware and/or viruses. I've had to remove this crap from 5 or 6 computers in the last month alone.
I'm posting to say: COMBOFIX. This thing magically removes Antivirus 2009 and 2010, even the rootkit versions that MBAM falters on (or that prevent MBAM from running, even in safe mode).
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Use it. Love it. Marvel at its simplicity, its beauty.
A classic, they are more interested in stoping you using different no-cd cracks then they are in your security.
Uninstall this crap.
Love many, trust a few, do harm to none.
See my other post on this subject. Antivirus XP (and variants) can be removed by hand but it's a tedious process. Malwarebytes removes it VERY easily though. With some Antivirus ($FOO) variants you do need to rename the Malwarebytes installer filename and then the executable filename but once you get the process launched it will fully automate the removal process. IMHO Malwarebytes is the very best ad/malware removal utility at the moment, with Spybot S&D and Superantispyware being tied for a very distant second.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
I work for a IT department here in California, and we get about three fake-antivirus-infected computers every week. Lately, the malware's been getting more difficult to remove- it's been hooking into system processes so that it can continually replace itself if part of the program gets deleted.
Thankfully, we've found a fairly nice remedy that doesn't force us to wipe the hard drive. Don't bother with Ad-Aware or Spybot S&D anymore- they've become very ineffective as of late.
First we hit it with a scan from Malwarebytes Anti-Malware, a free scanner you can download here: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol
Then, on the infected computer, we download and run (in safe mode) a somewhat obscure free program called Combofix, which is available here: http://www.combofix.org/
After that, we run one more follow-up scan with Malwarebytes to ensure that the computer is clean.
So far, this combination of steps has eliminated the infections that we've come across.
To remove norton, Don't bother with the uninstaller. Get the Norton Removal tool from their site:
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039
This is for ANY install of ANY norton products. It also gets rid of shared files and their registry settings.
In Soviet Russia, Trojan exploits YOU!
AVG 8 is so bad is makes me want to puke. It chokes my system worse than a real virus. It's a shame because up until 7.5 it ran like a dream.
Spybot is not that good. Get the Google pack of PC Tools Spyware Doctor or maybe the new Security Essentials and use Spybot to augment it with its immunization tools.
Combofix! Go download it and use it. it will slaughter those stupid antivirus xp 200x and all that jazz. I want to make out with whoever made it.
for compromised systems, one thing that works great in the cases where you can't is Process Explorer from Microsoft. It is a more detailed task manager so you can get more information on processes. That itself isn't useful. However, what it can do is suspend processes. You choose a process and there's a suspend option, as well as killing it. Well, what that does is allow you to shut this stuff down, but its watchdog process doesn't notice. It is still "running" it just doesn't get CPU time. So the main process can't stop you from modifying the system, and the watchdog doesn't know to reload it.
You then can make use of Autoruns, also from Microsoft. That shows you everything that starts up on your system. Use that to track down and remove the startup of the processes. Reboot to clear the file locks (or boot to a live CD), and delete the files.
I can get rid of all the malware I've thus far encountered manually using those tools and spending some time. We have to do it sometimes because professors refuse to let us reinstall, even though that is the best option, since I can never be 100% sure I cleared all threats.
I agree MalwareBytes is one of the best Win environment removal tools, but I was having about 20% re-infection rate with these entrenched AVPro infestations that were removed by MB(& Spybot). I also searched system folders for dll's newly installed and installed "BEFORE the OS" to unregister manually, then running MB and SB S&D again, in SafeMode w/ Restore Points deleted/disabled. Honestly, after all that work, it is most times easier/cheaper to image drive, nuke/repart drive(in DOS or EXT), reload OS and re-populate data & 3rds.
Oiyve'!
I have always used Puppy Linux LiveCD to remove stubborn files, but recently started running Linux LiveDiscs w/ Kapersky or Avira to do all removals the 1st time. Faster, easier and more effective, so far. Too soon to tell if it's the silver bullet I'm hoping for. Recently found a cool aggregate LiveCD builder on gHacks that makes one monster weapon. Still collecting all the parts, hopefully I can trade my 48 disk carrier in for 1 jewel case or a USB thumb drive.
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
You do realize that if your running two AV's they stomp on each other and nothing works
No always the case, You can use and Online Scanner with no problem.
Sadly they sometimes pick up things otherones miss.
http://housecall.trendmicro.com/
http://security.symantec.com/
http://www.kaspersky.com/virusscanner
Just to Name a few online ones.
I had a system last week infected with "Windows Police Pro"... I was able to remove it in about an hour.... (not easy.. but also not difficult - just using the combination of tools I mentioned above).. and got the User back up and working. *shrug* I don't claim to be a "genius"... but I do have years of experience.. and I've been doing IT Admin/support for long enough that my intuition (about how a system is behaving) is usually correct.. and I can be pretty effective when I'm "in the zone".
Security Essentials detected several:
- Adware: Win32/WhenU.A (Medium Alert Level)
- Adware: Win32/ClickAlchemy (Severe)
- Adware: Win32/ABetterInternet.C (High)
- Adware: Win32/SurfPlayer (High)
- Adware: Win32/NewDotNet (High)
To be somewhat fair to McAfee, it did detect a couple coming from one machine, MWS and SmartShopper, but this was very late in the process, well after the user had reported seeing the FakeAV pop-up and (apparently) after the machine had been infected. Perhaps these are McAfee names for some of the ones listed above and my reporting was just slow, don't know.
Also just for the record, we run EPO 4, Agent 4.0.0.1494 (as of yesterday, latest agent patch) and VirusScan 8.7.0i, Patch 1 (Patch 2 is out as of yesterday I believe, we'll be going to that soon). The so-called "Antivirus 2009" or "Antispyware 2009" and all it's variants have slipped past McAfee at least a half a dozen times in the past 3 weeks or so on our network. These are all domain machines, EPO protected, completely managed; it's not like we just have a hodge-podge of out of date titles or whatever. Go check out the McAfee forums, there are a few topics with people complaining about this as well.
I'm with you, I'm quite concerned about this. But outside of going around to 300 personal computer's (that's for the "CPU" nerdrage above) and scanning them individually with Malwarebytes or MSE I'm not really sure what to do. I'm kind of hopeful McAfee gets their shit, or rather their DAT's, together and can at least start alerting me on these, so we're not completely in the dark.
I've been through about 20 machines with this infection or variants there of (av360, av 2009, av2008, etc). I'm guessing I lost about four of them, the worst of course were the ones where the user went all the way through with the install, assumed they were protected and let the damn thing run for months, updates and all. One of those machines I'd just like to shoot. It powered off and wouldn't come back on for three months, then "bam!" it's running again. I'm thinking that thing won't be safe until the drive is zeroed and the bios is flashed. But, yeah, some of them are really F*ing hard.
Under the influence of Post-Cyberpunk Gonzo Journalism
I work for a computer repair shop, and we see AV20xx ridiculously often... We burned a CD with Malwarebytes 1.41 and SysInternals Process Explorer, and that's all it really takes to disable it, allowing for full removal. Make sure you rename procexp.exe to iexplore.exe and then kill the virus process, launch Malwarebytes and nuke. After that, fix any internet connectivity problems, install a trial of Sunbelt Vipre, then scan with both until clean. After that, do a final pass with the free version of PrevxCSI and remove files manually until it comes up clean. Viola!