AntiVirus 2009 destroying my computer (SOLVED!)

No-Quarter

So yeah, my father isn't exactly what we'd call tech-savvy, so when a popup told him our computer was at risk and the only way to fix it was to download Antivirus 2009, he walked right into the trap. Now I can't get rid of the blasted thing despite using AVG virus scanner. My tech buddy isn't around so I need your help PA. This thing keeps popping up constantly and occasionally blue screen's my ass. *Sigh*

capnrico

I'm assuming you have another computer you can use. Hopefully it can burn CDs.

Download the Avira rescue boot disk from here. Boot into it and do a full scan and clean (make sure you check the options and set it to clean, and not just report).

Download MalwareBytes AntiMalware here. Burn it to another CD, boot into safe mode, install it and run it. Clean everything it says is bad. Also run a virus scan in safe mode, clean everything out.

That should take care of it. I've beaten this thing down this way a few times over a few computers. I never had to deal with one where someone actually followed through when getting one of the "you are infected" popups, so it may get a bit more involved if that happens, but give it a shot.

TL DR

Wow, 2009 version already fucking lives. I had a problem with this bug on a friend's PC, and it was extremely resilient.

SeñorAmor

MalwareBytes is good, but also use Spybot. It clears up AV200X just fine.

No-Quarter

SeñorAmor wrote: »

MalwareBytes is good, but also use Spybot. It clears up AV200X just fine.

O rly? I'm downloading spybot now, it'll take some time to get use a friend's comp for those other discs. Let's see how spybot works it. This thing is even on my damn toolbar. Why the hell hasn't Microsoft's team of lawyers found these little bastards and sued them back to the stone-age?

Nakatomi2010

Process we use at work to ensure eradication...

Safe Mode with networking (Important)
Spyware Doctor, full scan
SpySweeper, full scan
Safety.live.com Full scan

Whole process takes a few hours, but when done you're clean...

Remove when done.

No-Quarter

OK, I ran spybot and it immediately recognized and eliminated FraudXPAV or whatever it IDed it as. It's off the tool bar now, which is encouraging, I'm still going to have my tech-head buddy take a look and run a full sweep in the near future. For now though, thanks for the help everyone!

Nakatomi2010

Ok... I have the reverse question he had.... In the interest of science, I need someone to either link here, or probably PM me a link to a site that infects a machine with a virus... Specifically I plan on infected a virtual machine so I can conduct some tests on some things....

Thanks for your efforts.... an odd request, but a serious one...

Buttcleft

If you have to work on a computer for more than an hour or two then I'm of the opinion that its less headache to just nuke the drive and reinstall.

Especially when virii are concerned. (Solved, I know, Just putting this out there for future reference )

Nakatomi2010

Buttcleft wrote: »

If you have to work on a computer for more than an hour or two then I'm of the opinion that its less headache to just nuke the drive and reinstall.

Especially when virii are concerned. (Solved, I know, Just putting this out there for future reference )

Depends on what's on the computer... My HTPC, I'd rather not have to do that primarily because I've got sooo much stuff I'd have to reconfigure, let alone the software installs and calling Microsoft to activate windows again... And my gaming rig, I'd really rather not install all those games again...

Crashtard

This has nothing to do with the solved thread topic, but I totally agree buttcleft. If I can't get rid of something in less than 30-40 minutes I just nuke and install. It's usually easier, and the computer always runs better after. This is also why I'm a hardcore believer, and keeper, of a backup drive.

Nakatomi2010

Meh, I have a Home Server now, so it's all kinda moot... If one of my machines becomes infected I just recovery to a couple days before, and copy over any files that've changed...