Simviation Forum - WARNING: "Advanced Virus Removal" is a virus itself!

	Search the archive:

Simviation Main Site | Site Search | Upload Images

Simviation Forum › Computer Hardware & Software Forum › Computer Games & Software › WARNING: "Advanced Virus Removal" is a virus itself!

(Moderators: Mitch., Fly2e, ozzy72, beaky, Clipper, JBaymore, Bob70, BigTruck)

‹ Previous Topic | Next Topic ›

Pages: 1 2

Send Topic

Print

WARNING: "Advanced Virus Removal" is a virus itself! (Read 1868 times)

Nov 16^th, 2009 at 8:25am

JBaymore Offline
Global Moderator
Under the curse of the
hombuilt cockpit!

Gender:
Posts: 10261

Warning here for everyone:

SOMEHOW.... I just got a "driveby" installation of this AWFUL piece of malware / virus. (Search the net..... it is a BAD persistent one.) It fakes that your computer is stuffed full of viruses and trojans. Then it tries to get you to buy this great new package. But it is totally BOGUS and a ripoff attempt.

DO NOT PAY FOR IT!!!!!!!!!!!!

I had to go into the registry multiple times, download some utilities, download Malwarebytes freeware spyware killer, manually delete tons of crap, use the "run" option to start stuff it was blocking form working, run WinXP in safe mode, and finally use an old restore point to get this thing killed.

It starts restricting your access to your own computer as you try to stop it. VERY devious piece of software. And the people who wrote it are reading the online tactics being posted ....and writing blocks as fast as people are suggesting them.

It took me a full day of literally full time work to get the D$#@ thing off my PC! And I have active antivirus and spyware blockers running. First time something like this EVER got thru the "walls".

Beware.

Malwarebytes remover seem to work for the last of it (after I did a lot of manual work), but the November 2010 version of the virus now will not let you install that remover once you are infected. THAT took some gymnastics to get around!!!!!!

It even eventually blocks stuff like Google searches! It disables TaskManager so you can't kill processes. It infects Internet Explorer and Firefox. It hides multiple copies in all sorts of places. It is all over the Registry. It installs folders everywhere. It is a real bugger!

So get that abovementioned piece of FREE software on your machine NOW....before you catch this one. And likel soon it won't just block the installation of the program... it'll block it working. So this is just an interim solution.

best,

.....................john

Intel i7 960 quad 3.2G LGA 1366, Asus P6X58D Premium, 750W Corsair, 6 gig 1600 DDR3, Spinpoint 1TB 7200 HD, Caviar 500G 7200 HD, GTX275 1280M, Logitec Z640, Win7 Pro 64b, CH Products yoke, pedals + throttle quad, simpit

IP Logged

Reply #1 - Nov 16^th, 2009 at 3:29pm

The Snake 87 Offline
Colonel
In Tippett We trust.
Michigan

Gender:
Posts: 145

Thanks for the heads up, I will definitely keep this in mind!

Phoenix Coyotes fan in Michigan. Yeeeaah booii.

IP Logged

Reply #2 - Nov 16^th, 2009 at 6:06pm

SubZer0 Offline
Colonel
KLNA

Gender:
Posts: 3882

The Snake 87 wrote on Nov 16^th, 2009 at 3:29pm:

Thanks for the heads up, I will definitely keep this in mind!

Wow... that sounds like a real B*tch, John. Glad you were able to get that thing taken care of... I could only imagine the damage it would have caused on your sim and the time it would have taken to reinstall all of that and your simpit Shocked

Shocked

I've been using Malwarebytes since Nick recommended... great little program that is. Wink

Wink

IP Logged

Reply #3 - Nov 16^th, 2009 at 6:47pm

a1 Offline
Colonel
Tied In A Knot I Am

Gender:
Posts: 8217

Thanks for the heads up.

790i : QX9650 : 4Gb DDR3 : GeForce 8800 GTX : 1 WD Raptor : 1 WD VelociRaptor 150

IP Logged

Reply #4 - Dec 1^st, 2009 at 1:28pm

jaime Offline
Colonel
I can haz fail now?

Posts: 248

I wonder if I had this at one point before reformatting my system...well not reformatting compleatly but rebuilding the file system...

cus my PC slowly started BSODing and other things like that...and then installer programs (well some times) wouldnt work correctly...hmmmm...

I use malwarebytes, spywareblaster and a few other utilities for antivirus (don't plan on mentioning what incase the idiots who like being shit heads and doing shit like this do happen to read this)...

oh and for the shit head who do this to others and happen to read threads like this...be warned your being watched...by who...you won't know...

one of the starters of the burner pandemic

IP Logged

Reply #5 - Dec 3^rd, 2009 at 11:07am

flaminghotsauce Offline
Colonel
I love YaBB 1G - SP1!

Posts: 181

This is hysterical to me. I never get anything like this. I am coming up on two years with no anti-virus, and only the wireless router as a firewall. Behind this firewall I've been running two Vista machines, one is now W7, several XP machines, a few Linux machines, and there are still a couple of windows 2000 machines.
I strongly urge Linux for surfing, online banking etc. as it's HARD to have an infection, intruder, etc. get hold of the machinery. But of course my gaming is on Windows....

I routinely work on other's machines and remove Norton and McCafee AV as I view them as viruses. I tell people to not go to questionable sites, buy a router, and not run AV. I have not had anyone yet complain that this simple formula hasn't worked. It all gets down to what you do while online.
There are sites out there that will spawn windows that look just like XP or VISTA windows that warn of stuff on your computer. It's especially funny when surfing on a Linux distribution to see an XP window pop up!

IP Logged

Reply #6 - Dec 3^rd, 2009 at 4:27pm

machineman9 Offline
Colonel
Nantwich, England

Gender:
Posts: 5255

Any software popping up claiming you have viruses/asking you to pay, is usually a virus itself. They have been going around for years. If you didn't get the program yourself, then it is going to be fake. I did not install 'Antivirus 2009', so when it pops up telling me I have a virus, it is clearly a fake as I never installed it on my computer (if it was legit, which it isn't).

Old tricks, but they still catch people out. Also, read, to the letter, what a lot of those pop ups say. Usually there are quite a few typing mistakes which is another sign that they are fake.

IP Logged

Reply #7 - Dec 4^th, 2009 at 7:34am

ShaneG Offline
Colonel
I turned into a Martian!

Posts: 10000

Some of these pop-ups are designed to install the virus to your system, if you click the 'Red X' to close the window.

If one pops up, it's best to close the window from the task bar.

IP Logged

Reply #8 - Dec 6^th, 2009 at 1:59pm

JBaymore Offline
Global Moderator
Under the curse of the
hombuilt cockpit!

Gender:
Posts: 10261

ShaneG wrote on Dec 4^th, 2009 at 7:34am:

Some of these pop-ups are designed to install the virus to your system, if you click the 'Red X' to close the window.

If one pops up, it's best to close the window from the task bar.

Yup.... devious little devils. Click anywhere on them and bingo........ virus install.

Some of these do a great impersonation of a Windows System message too........ that you then innocently click on.. ..... and Bingo! Virus install again.

I use Task Manager to kill "unknown" pop-up windows....even if they look like Windows messages.

best,

..................john

Intel i7 960 quad 3.2G LGA 1366, Asus P6X58D Premium, 750W Corsair, 6 gig 1600 DDR3, Spinpoint 1TB 7200 HD, Caviar 500G 7200 HD, GTX275 1280M, Logitec Z640, Win7 Pro 64b, CH Products yoke, pedals + throttle quad, simpit

IP Logged

Reply #9 - Dec 6^th, 2009 at 2:36pm

Steve M Offline
Colonel
Cambridge On.

Gender:
Posts: 4097

I have had a couple of these buggers in past years. I used to push the power button on the case and shut down immediatly. Last spring that didnt even work. I just tossed my hard drive and formatted a new one. Nothing I had in my arsenal wanted to recognize what it was. Whatever it was it moved through the system slowly over three days, corrupting one program after another, untill finally I couldn't boot anymore. I even disconnected the ethernet cable at the first sign of trouble.

Flying with twins is a lot of fun..

IP Logged

Reply #10 - Dec 6^th, 2009 at 9:10pm

machineman9 Offline
Colonel
Nantwich, England

Gender:
Posts: 5255

Steve M wrote on Dec 6^th, 2009 at 2:36pm:

I have had a couple of these buggers in past years. I used to push the power button on the case and shut down immediatly. Last spring that didnt even work. I just tossed my hard drive and formatted a new one. Nothing I had in my arsenal wanted to recognize what it was. Whatever it was it moved through the system slowly over three days, corrupting one program after another, untill finally I couldn't boot anymore. I even disconnected the ethernet cable at the first sign of trouble.

Destruction is not the best means of recovering.

Booting into safe mode and running a variety of anti-virus and other clean-up programs should clear up most of those issues as it will stop the virus from activating/hiding/moving around/infecting, so then you can remove it.

IP Logged

Reply #11 - Dec 7^th, 2009 at 5:50pm

Steve M Offline
Colonel
Cambridge On.

Gender:
Posts: 4097

machineman9 wrote on Dec 6^th, 2009 at 9:10pm:

Steve M wrote on Dec 6^th, 2009 at 2:36pm:

I have had a couple of these buggers in past years. I used to push the power button on the case and shut down immediatly. Last spring that didnt even work. I just tossed my hard drive and formatted a new one. Nothing I had in my arsenal wanted to recognize what it was. Whatever it was it moved through the system slowly over three days, corrupting one program after another, untill finally I couldn't boot anymore. I even disconnected the ethernet cable at the first sign of trouble.

Destruction is not the best means of recovering.

Booting into safe mode and running a variety of anti-virus and other clean-up programs should clear up most of those issues as it will stop the virus from activating/hiding/moving around/infecting, so then you can remove it.

I know, but I couldn't boot in safe mode at all. Turned out to be a blessing in disguise, I got rid of a bunch of junk I didn't need.

Flying with twins is a lot of fun..

IP Logged

Reply #12 - Dec 12^th, 2009 at 8:30pm

jaime Offline
Colonel
I can haz fail now?

Posts: 248

flaminghotsauce wrote on Dec 3^rd, 2009 at 11:07am:

This is hysterical to me. I never get anything like this. I am coming up on two years with no anti-virus, and only the wireless router as a firewall. Behind this firewall I've been running two Vista machines, one is now W7, several XP machines, a few Linux machines, and there are still a couple of windows 2000 machines.
I strongly urge Linux for surfing, online banking etc. as it's HARD to have an infection, intruder, etc. get hold of the machinery. But of course my gaming is on Windows....

I routinely work on other's machines and remove Norton and McCafee AV as I view them as viruses. I tell people to not go to questionable sites, buy a router, and not run AV. I have not had anyone yet complain that this simple formula hasn't worked. It all gets down to what you do while online.
There are sites out there that will spawn windows that look just like XP or VISTA windows that warn of stuff on your computer. It's especially funny when surfing on a Linux distribution to see an XP window pop up!

Same here, Though I do use AV...just not as much...hehe

machineman9 wrote on Dec 3^rd, 2009 at 4:27pm:

Any software popping up claiming you have viruses/asking you to pay, is usually a virus itself. They have been going around for years. If you didn't get the program yourself, then it is going to be fake. I did not install 'Antivirus 2009', so when it pops up telling me I have a virus, it is clearly a fake as I never installed it on my computer (if it was legit, which it isn't).

Old tricks, but they still catch people out. Also, read, to the letter, what a lot of those pop ups say. Usually there are quite a few typing mistakes which is another sign that they are fake.

I actually purposly went to a site that I knew had one of these things on it just so I could grab the source HTML code...interesting code and well....it was a good laugh...love them...sad there are people who would do some thing as dumb as this but hey could be worse...

*mockingly* OOOOO You're infected, buy our software which is a virus, it will protect you....

YEA RIIIIIIIIIIGHT...Ill just "borrow" your code and see how it could be used to stop idiots from doing stuff like this....or better yet educate every one I can....that's a better idea....LOL!!!

Steve M wrote on Dec 7^th, 2009 at 5:50pm:

machineman9 wrote on Dec 6^th, 2009 at 9:10pm:

Steve M wrote on Dec 6^th, 2009 at 2:36pm:

I have had a couple of these buggers in past years. I used to push the power button on the case and shut down immediatly. Last spring that didnt even work. I just tossed my hard drive and formatted a new one. Nothing I had in my arsenal wanted to recognize what it was. Whatever it was it moved through the system slowly over three days, corrupting one program after another, untill finally I couldn't boot anymore. I even disconnected the ethernet cable at the first sign of trouble.

Destruction is not the best means of recovering.

Booting into safe mode and running a variety of anti-virus and other clean-up programs should clear up most of those issues as it will stop the virus from activating/hiding/moving around/infecting, so then you can remove it.

I know, but I couldn't boot in safe mode at all. Turned out to be a blessing in disguise, I got rid of a bunch of junk I didn't need.

Safe mode (if you can get to it) is good for that IF you can get your anti virus and what not updated to the most current defitions with out causeing the intruder to activate...

as for the HDD...hope you took a hammer to it before tossing it...cus I love people who just toss the old hard drives out and don't take a hammer to them...hehe

Oh and for those of you who are unfortunate enough to get this evil...sick...low down POS "program" installed on your PC...keep reading...the following will be helpful and DO IT QUICKLY (as in first time you notice it find it and kill it with vengeance...)

Advanced Virus Remover manual removal:

Kill processes:
AVR.exe

HELP:
how to kill malicious processes: Ctrl + Alt + Del, then locate the process you need to kill and right click on that process, then hit END PROCESS TREE

Delete registry values:
HKEY_CURRENT_USER\software\avr lastd
HKEY_CURRENT_USER\software\avr lastscan
HKEY_CURRENT_USER\software\avr lastvfc
HKEY_CURRENT_USER\software\avr virlist
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run advanced virus remover
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run advanced virus remover
HKEY_CURRENT_USER\Software\AVR
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International\CpMRU

Delete files:
AVR.exe Advanced Virus Remover.lnk

HELP:
how to remove harmful files: use a drive eraser utility like eraser (allows you to erase and over write files)

Delete directories:
C:\Program Files\AdvancedVirusRemover

again if this pops up on your screen, close it and immeadiatly go on a hunt for its parts...

one of the starters of the burner pandemic

IP Logged

Reply #13 - Dec 12^th, 2009 at 9:33pm

JBaymore Offline
Global Moderator
Under the curse of the
hombuilt cockpit!

Gender:
Posts: 10261

jamie,

The newer versions of this one shut off your access to using Task Manager. So you can't simply kill processes using that method. They'll also eventually stop you from using certain Google search functions, and will kill Windows Explore too.

You are right about "do it fast"...... the more time you try to "kill" it and don't get it all... the more stuff it shuts off on you.

The idiots that wrote this particular one are monitoring the web and as "fixes" get posted on the various anti-spyuware/virus sites... they are plugging the leaks in their BS code. Angry

Angry

Roll Eyes

best,

................john

Intel i7 960 quad 3.2G LGA 1366, Asus P6X58D Premium, 750W Corsair, 6 gig 1600 DDR3, Spinpoint 1TB 7200 HD, Caviar 500G 7200 HD, GTX275 1280M, Logitec Z640, Win7 Pro 64b, CH Products yoke, pedals + throttle quad, simpit

IP Logged

Reply #14 - Dec 13^th, 2009 at 6:02pm

jaime Offline
Colonel
I can haz fail now?

Posts: 248

indeed, thats true....as for fixes its sad they are stupid enough they are doing stuff like that to try and make people think they are infected and all that...

thats why when ever I get a call like this at my work I educate the person about this stuff so they don't get all scared (plus they use macs not PCs)

one of the starters of the burner pandemic

IP Logged

Pages: 1 2

Send Topic

Print

‹ Previous Topic | Next Topic ›

Top of this page

Simviation Forum » Powered by YaBB 2.5 AE!
YaBB Forum Software © 2000-2010. All Rights Reserved.

Valid XHTML

Valid CSS

Powered by Perl

Source Forge