Comments on: HOW TO: Remove Fake Antivirus Software

By: Mathdelane

Mathdelane — Tue, 22 Jun 2010 11:40:25 +0000

@Annie
Regarding your first question, yes, you can try doing that. There are I think some browsers that work on thumb drives so you can try that route. Also, I’ve experienced this before but what I did was download Spybot Search and Destroy then run it. It killed the virus on my PC. I hope this helps.

By: Annie Goodwin

Annie Goodwin — Mon, 07 Jun 2010 17:43:56 +0000

Okay. Somehow, one of these nasty little suckers took over my computer. I cannot bring up any of the antivirus scanners I have on my computer. They are immediately shut down by the fakeantivirus which calls itself “Systintell” or “Systemintal”. Can’t remember exact name. McCaffee is usually running in the background at all times, but on this day, it must have shut itself off.

In any event the fakeantivirus will not allow me to download or install anything like spybot or avast or removefakevirus. In fact, when I try to get to a site like yours I am automatically rerouted to any other site.

Can I possibly download one of the fixes to a usb port, then upload it to my computer before going on the net? Will I be able to run it and kill the fakeantivirus before it realizes what I’m doing?

I mean, I am planning on getting a new CPU or maybe a laptop anyway, but I’d really like to have ALL the money on hand before I do that. ^_^

Thanks for any ideas….

By: jballem

jballem — Tue, 04 May 2010 00:16:13 +0000

My wife’s laptop was recently infected by a rather nasty drive-by fake antivirus app called “Windows Antivirus Tool”. The trickiest thing about this malware is that it launches at startup and won’t allow you to run any malware removal tools. You can’t even open a command prompt or restart an infected computer in safe mode.

After some research, I found out that the .EXE resides in a numeric folder buried in the Documents and Settings/All Users/Application Data folder. Once I found that folder, I renamed it and then restarted my wife’s PC. Because I had renamed the folder where the .EXE file lived, it didn’t load at startup. I was then able to run Malwarebytes which removed all traces of the malware from my wife’s HDD and registry.

Tricky little bugger. Again, it was a drive-by. My wife simply visited an infected webpage and the malware was on her machine.

By: Jason Paisley

Jason Paisley — Fri, 16 Apr 2010 23:36:29 +0000

I don’t expect much from free AVs however Microsoft Security Essentials has been impressive. Seeing as i run LINUX i’ve not been concerned with it but when i get a system sent to me to repair due to a fake AV it’s a case of the true AV the consumer has not being kept up to date. Regardless of free or paid for AVs if it’s not kept up to date it’s bloody useless.

By: Sire

Sire — Sat, 27 Mar 2010 22:02:03 +0000

I make sure I never open an executable file unless I get it from someone I trust and even then I scan it for virus's first. Fortunately I've never had a virus attack to date. Still it's comforting to know that it can be dealt with, Thanks for the post Mathdelane. .-= Sire´s last blog ..Why Alexa Is More Important To Me Than Google Page Rank =-.

By: Virus Alert: Facebook Password Reset Confirmation Support Message Attachments

Virus Alert: Facebook Password Reset Confirmation Support Message Attachments — Fri, 26 Mar 2010 11:16:50 +0000

[...] Here’s my follow-up post regarding this incident, How To Remove Fake Antivirus Software. [...]

By: James Moralde

James Moralde — Wed, 24 Mar 2010 13:40:22 +0000

Cool. Thanks for confirming these three can work together. That means, I don’t have to spend time experimenting.

By: Bob

Bob — Wed, 24 Mar 2010 13:34:32 +0000

In our office we use AVAST + Malwarebytes combo to avoid this kind of infection. But still encountered this one when one of our employees accidentally open an attachment containing this malware. Thanks for the steps man.

By: Mathdelane

Mathdelane — Wed, 24 Mar 2010 07:36:10 +0000

You’re welcome, James! I use Spybot alongside AVG 9.0 and MalwareBytes and had no issues with it.

By: James Moralde

James Moralde — Wed, 24 Mar 2010 07:31:33 +0000

Thanks for the follow up post Math. I already have AVG. I'm looking into Spybot and see if it wouldn't conflict with the other similar software already in my station. .-= James Moralde´s last blog ..Possible Facebook Trojan Effect: Probable Free Trojan Removal Solution? =-.

By: Possible Facebook Trojan Effect: Probable Free Trojan Removal Solution?

Possible Facebook Trojan Effect: Probable Free Trojan Removal Solution? — Wed, 24 Mar 2010 06:50:49 +0000

[...] just came from Mathdelane’s SoftwareCriticsInfo site where he was discussing about a Fake Antivirus Software which one can contract from an email that tries to pass itself as coming from Facebook Support. [...]