Fake Alert Virus(Antivirus 2010)

[jbergey22]

I just spent around the past 14 hours getting this crap removed from my computer. I was looking at this forum when it decided to install itself. I had other windows open so I cant be certain that it came from here.

Anyway, the tricky virus did these things.
1. It disabled my registry editor
2. It disabled the use of .exe files
3. When I did finally get back on the internet it blocks you from searching for things such as Combofix, Malwarebytes, and Fake Alert.
4. It screws with the browser to if you type in www.malwarebytes.org (http://www.malwarebytes.org) it will send you to some advertisement screen
5. Disables system restore
6. Will not allow you to run programs to fix the problem such as combofix or malwarebytes

What I had to do
1. I had to find this program that re-establishes the registry editor
2. Once I could get into the registry editor I had to edit the registry editor so I could use .exe files again
3. Luckily I had a previous version of combofix on my computer so I changed the name and was able to finally run it. Once I ran combofix I was able to download Malwarebytes by also changing the name of that file.
4. Now I have ran 2 complete system scans with CA and Malwarebytes and found around 45 infected files but it seems to be back to normal.
5. Redownload IE 8
6. Run CC Cleaner to fix everything the virus fucked up.

Long story short, dont let that piece of shit get on your computer.

[Alan T]

Once you have antivirus 2010 on your system, you are correct, it is a pain to remove.

Sorry to hear that it happened to you. The best method for other users (or you in the future) to prevent against this type of attack is by use of an application similar to no-script (add on for firefox browser). For people who insist on using Internet explorer, they don't have a no-script type of add on to protect you, so you have to turn off a ton of java and scripting functionality in your Internet explorer settings and/or set your site security to be very strict.

The biggest way this (and other similar attacks) get to you is not by infecting sites like FOFC, but instead they tend to hack into advertisement sites, and hack the advertisement banners which ends up being very difficult for sites to then track down. Blocking the ad banners from getting to your system would protect you roughly 60% at the least.

Good luck in cleaning it up and hopefully it didn't effect you any financially (through access of bank account information or whatever you might have had stored on your computer)

[jbergey22]

Great advice Alan. Them banner ads do seem to cause a majority of my problems. I will download that additional browser. I may use Opera instead of Firefox. Ive always felt Firefox is just too slow(probably in my head)

I am hoping the financial information is safe. I only use secure websites for that so I am hoping that wont be a problem. Thanks for the heads up on that though.

[illinifan999]

I got the same thing viewing the winter olympics thread yesterday and have been dealing with it since. Just re-formatted, now going through the mind-numbing process of bringing everything back.

[MizzouRah]

Run superantispyware in conjuction with malwarebytes..

[MikeVic]

I bet it was that Dale Begg-Smith skier that installed it.

[DaddyTorgo]

I bet it was that Dale Begg-Smith skier that installed it.
prolly. fuckin asshole.

[Alan T]

I may use Opera instead of Firefox. Ive always felt Firefox is just too slow(probably in my head)




No, I do too think Firefox feels sluggish and is not as fast, but the only reason I use it is for no-script which I haven't found much comparable out there.

I am not familiar with Opera though, so not sure what you need to do in it to be secure. If it doesn't have some kind of protection though, simply using a different browser is not enough to protect you if it still allows through javascripting or iframe execution.

[Noop]

I think the people who make that stuff should be sodomized with a huge cumbersome object.

[Marc Vaughan]

I had to spend an afternoon removing that from my sister in laws PC six months or so back - was a right sod to do, would have been much more awkward apart from the fact I had a laptop with me to 'cleanly' download stuff on and transfer across.

[sabotai]

My brother's computer got hit with something similar (Antivirus Plus). Spent a few days trying to get that shit removed but couldn't. He ended up just reformatting the hard drive.

[MrDNA]

I got this fucker and had to have my computer remotely repaired by McAfee. What a friggin' pain. I agree with the cumbersome sodomy comment above.

[cougarfreak]

My wife got this on her computer last week, I ran malwarebytes, and did a system restore in safe mode, and it did the trick.

[jbergey22]

My wife got this on her computer last week, I ran malwarebytes, and did a system restore in safe mode, and it did the trick.


I wish I would have thought of that.

[BYU 14]

RKILL wil stop it from disabling programs that can clean it as well. I dealt with this and because of some residual damage ended up dropping a couple of hundred bucks to get my system right, pain in the ass and Noop, plain sodomy is not enough. Flaming large cumbersome objects would be my choice.

[Drake]

Purely objectively: from a coding standpoint, that's a pretty clever virus. It would make me want to hunt the programmer down and shit in the smoking bullet holes I had just pumped into his skull.

[Julio Riddols]

This is what happened to me recently as well. Effin lame. Had to wipe after a restart and virus/malware scan in safe mode resulted in my windows not being able to load properly, causing a log on then immediately log off issue when I restarted the computer.. It also would only boot in safe mode for some reason, even when I asked it to boot in normal mode. Eventually tried reinstalling over the old windows install when recovery console failed to work, then wiping and reinstalling windows when that didnt work, but then said eff it, moved on to Ubuntu 9.10 and use WINE now. Much happier than I was.

[Oilers9911]

Yep, Malwarebytes/SuperAntiSpyware does the trick.

[GrantDawg]

Has anyone came up with anything better for this? Kids have the laptop in a bind, and when my wife's system did this I had to clean boot as nothing else worked.

[Saul Goode]

I got that sob...that thing claws its way into everything and is a pain. Make sure you use combo-fix and make sure u check the mbr (master boot record). It likes to replace that with its own version. If im not mistaken rkill is useful also. It shuts down known viral processes so it can be semi-functional again.

[Marc Vaughan]

Do a google search and there are tools for removing all of this sort of things out there:

How to remove Antivirus 2010 (Uninstall Instructions) (http://www.bleepingcomputer.com/virus-removal/remove-antivirus-2010)
Looks a reasonable starting place ... but do bear in mind I haven't used that approach myself.

(I've had to fix this issue TWICE on my sister in laws computer in the past year or so .... and once on my wife's ... gotta love being known as a computer geek ;) )

[whomario]

i had it (or sth very similar, was called AV Security Suite) as well a couple days ago and ultimately all i needed to do luckily was to restore my system to an earlier date (2 days), so if you have that option on this should be your first bet.

One thing to get started is to access the taskmanager directly after startup, then you can disable it´s process (in doubt disable everything you can´t associate with sth you have installed normally) for the time being giving you a bit of time to run your programs, then this one helped me out a ton :

Antispyware Soft (AntispywareSoft) Virus Removal Guide | Virus Removal Guru (http://www.virusremovalguru.com/?p=6088)