Xp Av 2009

Printable View

11-13-2008
Yarin

Xp Av 2009

A friend's computer got infected with XP Antivirus 2008 last year, after looking up on how to remove it, none of the registry keys or system-looking files that all the pages kept telling me to remove where there. Except for one class ID that would reappear every time the system started. To fix this problem, I made a "vundo patch" program that would remove it after startup, this prevented it from hooking IE, allowing for smooth surfing.

But last week his infection grew to XP Antivirus 2009. I'm assuiming this is an invisible undate feature of vundo. Well, again, I looked up how to remove it, and the same problem. None of the keys or files where there, not only that, removing that class ID no longer did the trick.
How do you remove a virus that "isn't there"!?
11-13-2008
CornedBee

Reinstall.
11-13-2008
Yarin

I thought of that already, the problem is, it's XP which means my copy won't work on his computer. And he doesn't own a copy of his own.
I'm looking for an alternitive to spending a bit of money.
11-13-2008
MeTh0Dz

Checking for rootkits seems like the next logical step.
11-14-2008
psychopath

The only way I've ever been able to remove Av 08/09 is with system restore or a complete reinstall. All the pages that appear online seem to be out of date, with respect to what to delete and where to find it. Although if you look in Program Files, I believe there is a key file in there somewhere. Should live in oddly named folder you don't recall installing.
11-14-2008
cpjust

Don't Antivirus programs find & clean it properly?
11-14-2008
laserlight

It is malware masquerading as antivirus software.
11-14-2008
cpjust

Quote:

Originally Posted by laserlight

It is malware masquerading as antivirus software.

Yes, and any respectable AV program should recognize that and be able to remove it.
11-15-2008
michaelp

Has he tried Spybot S&D?
I think I got that once, and Spybot worked.
11-15-2008
Yarin

I haven't talked to him in few days, so I dunno if his newly-bought ZA will work or not.

Spybot: Aren't they another one of those "you can scan for free", but "register to remove the infection" programs?
11-15-2008
Elysia

Quote:

Originally Posted by Yarin

Spybot: Aren't they another one of those "you can scan for free", but "register to remove the infection" programs?

No, it is 100% free.
11-15-2008
SlyMaelstrom

Quote:

Originally Posted by michaelp

Has he tried Spybot S&D?
I think I got that once, and Spybot worked.

I haven't touched Spybot in a while. I downloaded it when it first came on the scene and loved it. Then all the sudden it appeared to start falling behind on its updates and wasn't getting all of the spyware on the disk. I then switched to Ad-Aware and have since then started subscribing to Norton Internet Security which has given me no reason to look back thus far. The new Norton is even good on resources.
11-15-2008
Elysia

Ad-aware is typically inferior to Spybot in all of my tests that I have done, though (it fails to detect a lot of things).
11-15-2008
Shakti

I have always found that there is no one malware remover that catches them all. I suggest you use both Ad-Aware and Spybot to search for it and others. In my experience they both find a little different things and together they are good ways of having a clean system.
11-15-2008
SlyMaelstrom

Quote:

Originally Posted by Elysia

Ad-aware is typically inferior to Spybot in all of my tests that I have done, though (it fails to detect a lot of things).

Perhaps now, but for a while it was no contest. As implied, I haven't used either of the products in quite a while now. Spybot may have improved and/or Ad-Aware might have degraded.

Anyway, regardless... the threat in question is fairly old news and, as said above, any Anti-Virus or Anit-Spyware application worth its weight should be able to remove it completely.
11-18-2008
SMurf

I successfully beat this twice in work by dropping into Safe Mode and doing a search for all files with a modified date around the time the problems began.

IIRC it gets into the user profiles so every time anyone logs in it makes a new copy of itself. I never quite worked out exactly how it kept doing this but killing the files (including a file that appeared in %systemroot%\system32\drivers, eep) stopped it dead. ;)

Even if you're having a hard time figuring it out, sometimes the simplest things will work. Removing all NTFS security permissions from the "visible" executable (I say "visible" because in this case there's something you won't see that will keep creating this file) will prevent it from being ran or modified so it will be similarly knackered. Note that this trick doesn't always work against things that randomly generate filenames, it'll just pick another.