The Antivirus 2008 and Antivirus 2009 Nightmare
62
Through the Eyes of a Non-IT Person
I have been through the "Antivirus 2008 Thing" (nightmare) and, as far as I know, removed it from my machine. I realize it is not Antivirus 2009, but I'm under the impression the two are very similar. In addition to the different years in the names, I am reticent about offering my experience, in view of the fact that I am not "a computer person".
At the same time, it is precisely because I am not "a computer person" and believe I removed the problem successfully (but only after mistakenly installing their phony software) that I thought it may be worth sharing the experience - not just with the Antivirus infection, but with removing it, and with sites that offer ways of removing it.
It is with reservation, and the recommendation of looking for input from other people who believe they have removed the virus from their own machines, that I'm offering my own experience with it. I'm also offering the following with the caveat that, although I have no reason to believe anything is left in my machine, there is the possibility that I am not sufficiently knowledgeable to state that with certainty.
Knowing that I'm not "a computer person", my original instinct was to refrain from sharing my Antivirus experience. What caused me to overcome that instinct was my belief that "non-computer people" can also be taken advantage of, or victimized by, others who know how to scare them in the same way Antivirus does.
Antivirus 2009 (like its predecessor, Antivirus 2008) shows up in the form of a security warning window, complete with an icon that looks like the Windows security icon, and tells the user that a threat/virus has been detected. It is considered, "rogue anti-spyware".
If the individual pays in order to fix problems, no problems that exist are fixed, and there may be additional Spyware installed.
The user cannot simply close the warning window, and it seems as if the only way to get rid of the "dire" warning is to click on the option (in the window) that will take care of the "risk". Not being entirely sure what else to do, users often click on that button that will install the software that will scan for viruses (which are exaggerated) - only to discover that no clean-up is going to occur without paying for it. The "warning window" also prevents all other activity. Shutting down the machine does nothing.. The window shows up again once the machine has been rebooted.
The best way to prevent infection is, of course, to have an up-to-date anti-virus/anti-malware program that will detect Antivirus (and its clones) specifically. The trouble is even on machines that have presumably good anti-virus software the virus can get in under certain circumstances. Once it does it can freeze up the screen and make running anti-virus programs (scans and fixes) seemingly impossible.
Some folks recommend shutting down the computer and starting it up again in Safe Mode. To do that, after turning the machine on and hearing the beep, press F8 a few times. Some have said that from there one can view program files on the computer and find at least one of the Antivirus files. Deleting that has been said (by some) to make the machine functional enough to run or update the machine's existing anti-virus/anti-mal ware program or to find a better one, download it, and run it (after rebooting in normal mode). This apparently gets rid of whatever is left of the virus.
In my online travels I've seen it recommended that the person without up-to-date anti-malware software on his machine could (if necessary) get a free download on another PC, transfer it to a flash drive, and then install it on his own machine.
Whether this works for everybody or is the best way rid one's machine of Antivirus is something I don't know, but I wish I'd known to try that first the evening I got the pop-up "scare warning".
Like many people, I wasn't entirely sure that the "security warning" was not a Windows warning; and without being able to do anything else, I did the very thing everyone is told to "never do" - downloaded what I thought would be the "fix". I had never heard of Antivirus, the virus. I'm not even sure I realized I was actually about to install the thing. I think I was just clicking everything to in an attempt at least minimize the warning window. I did not get to the point of paying for a make-believe fix before realizing there was a major problem.
Attempting to uninstall through the usual "Add/Remove Programs" results in only partial removal of files. Some (at least one) remain in the machine, an icon remains on the task bar, and it is clear that that everything has not been removed by uninstalling.
NOTE: I removed the Antivirus 2008 download with the steps that follow below - but only after doing what everyone is always told never to do, which is download the Antivirus "security" program. There are, of course, ways to remove Antivirus without installing their program, only to discover they want money to fix the problems that didn't exist before their virus got into your computer. What, if anything, goes on "behind the scenes" once a user downloads their program is something I don't know.
I have since read (on a site that is appears to promote an automatic detection program, but that states it is for security and education purposes only) that attempting to manually remove Antivirus "may be difficult and you run the risk of destroying your computer". In other words, there are sites that will give you step-by-step instructions to remove the "warning window" at the risk of destroying your computer; and the only truly safe way (particularly for the "non-computer person") to remove the virus is through software that will do it for you.
It is generally not recommended to attempt to manually remove Antivirus because if absolutely ever correct step is not taken some advanced spyware parasites can automatically repair themselves. Mistakes in the step-by-step process can result in permanent damage to your computer. People less knowledgeable than experienced IT professionals are advised (by IT experts) not to attempt this process.
To the best of my knowledge, I removed all Antivirus files (but only after installing) with the following procedure. More than one scan has shown no signs of any problems since, and the machine has been operating without problems for several months now. After removing the Antivirus one scan may have shown malware (not necessarily appearing to be Antivirus), but fixing it seemed to take care of that. My PC runs on WIndows VISTA, if that makes any difference.
The site to which I refer above presents a very complicated process (WITHOUT installing) that would likely intimidate a "non-computer person" ; and at this point, it has me wondering whether my approach left something in my machine that I don't know about. At the same time, it appeared very much to me that the following steps successfully removed the Antivirus "disaster". Had I seen the aforementioned site before I clicked on "install" I would 1) have known that Antivirus is a virus but 2) been afraid to either install it OR to attempt to remove it.
I am not recommending installing it in any way - only describing how I seem to have gotten rid of it, after installing it (the way so many people apparently do).
I am offering my own experience with the caveat that, even though I see no reason to believe any Antivirus was left on my machine, apparently there are others out there who say that my relatively simple approach may not have been adequate and/or, of course, that downloading Antivirus was the worst thing to do. At this point, I don't quite know what to believe; although I do remain somewhat suspect of a site that offers a complicated way of attempting to manually get rid of Antivirus, says doing it may destroy your computer, and then offers a link to an automatic detection program. I don't know what to think about either that particular site, or about the ability to completely remove Antivirus in as relatively easy (although somewhat "pain-in-the-neck-y") way that I believe I was able to. I understand that the site mentioned offers a way to manually remove the virus without installing Antivirus (obviously, the best option - provided one doesn't destroy his computer by trying to do that). The recommendation for automatic detection software is not one that I would dispute.
On the one hand, I realize that legitimate sites, aimed at offering genuine help to people, exist. On the other hand, in view of the fact that my machine has not had any signs of virus or problems since I removed Antivirus; I can't help but consider "conspiracy theories" when it comes to sites dealing with the Antivirus problem and any additional downloading of anything (whether that be for a price or for access to people's computers).
Installing anything is always extremely risky. Knowing then what I now know, but without knowing for sure that Antivirus does nothing more than try to sell software, I never would have been tricked into installing it. I was - and neither of the two computer experts in my life were around - so my machine would have remained inoperable until they were. Even if they were I'm not sure I would have been very comfortable risking "destroying" my computer by letting them try to manually remove the virus. Essentially, manually removing the virus without installing Antivirus has been said to be "close to impossible".
HOW I REMOVED ANTIVIRUS 2008 ONCE IT WAS INSTALLED
A file search for "Antivirus 2009" will show where the remaining file is. (For anyone who does not happen to know how to search for a file, click on the "Start menu" by clicking the Windows icon at the corner of the screen. More detailed instructions about searching for a file can be viewed by clicking on "Help and Support".) I just did a general search, but if someone else's system requires specifying where to search, search "Computer".
Once the remaining file(s) show up open the folder in which the file is located.
The benefit of doing a search is that you may not know what you're looking for, and the machine will show you what the file looks like. A search may not be necessary if you know what you're looking for, and if you know that the problem file may be located in system files. Still, a search shows you exactly what to look for, and where.
After locating the problem file the user may not be allowed to delete files without going through the process of establishing him/herself as an "administrator". Computers with only one user will not present a problem (although the user may to, essentially, click on the box that tell the machine, s/he is an administrator).
Computers with more than one user will require the password of the user "established" as the administrator. It is possible to have more than one administrator, but it requires that "main" password in order to establish other users as administrators.
I don't happen to recall whether right-clicking on the file allowed me required "uninstalling" or "just deleting", but I believe I just deleted it. At the time, it appeared to me that the remaining file was responsible only for my not being able to get rid of the icon on the task bar (although I know, of course, something less "innocent" could also have been associated with that file).
Whether or not my machine has some latent file somewhere that will later cause problems, or that is doing something now, I can't be sure. The machine, however, operates well and multiple security/malware scans show no problems.
Essentially, through my non-IT-person eyes, it appears that once the "scare window" pops up the aim is to get the computer functioning enough to run (or install) a good anti-virus software aimed at catching this particular one (and its clones) - hence, the first step would be to reboot in Safe Mode and take it from there.
For the person who, like I did, frantically starts clicking to try to at least minimize the window, and who inadvertenly or otherwise mistakenly clicks himself into installing that first thing, using Add/Remove programs to uninstall most of it; and then finding the "leftover" in the system files seems to get rid of it.
Asking the user to pay under these circumstances should be the big tip-off that the program is malicious. Also, anyone without lots of IT experience and knowledge should never try to find/follow online instructions for manually removing the virus.
It appears to me that if one doesn't take the next step to paying money to download yet more Antivirus junk, and if one doesn't attempt to do only what an IT specialist should attempt to do; there's a good chance Antivirus 2008/2009 may be little more than a giant pain-in-the-neck. Of course, I don't know what I don't - and that does concern me.
PrintShare it! — Rate it: up down flag this hub








