Antivirus Live Hijack -- How I stopped it.

[travelingtypist]

So this balloon showed up in my Security Center saying I didn't have protection -- I have AVG. Then a program starts running that seems to be scanning my computer. It's running in the task bar, but I can't right-click on it to shut it down. I can't open the task manager to shut it down. CTRL-ALT-DEL came up with a little popup saying tskmgr is infected. No internet pages would open.

I did a hard shutdown of the computer, disconnected the Internet air card, restarted in safe mode, did a system restore to two weeks ago. So far so good, things seems to be running okay.

This thing is evil.

[CK_John]

1. Good save but...the registry has been replaced but the files and system restore

may still carry corrupt files. I would suggest the following create a new restore point, do disk cleanup from start->accessories->system tools->more options and clear all restore points except most current.

Then I would reboot into safe mode(hit F8) and run a full scan with MalwareBytes and let it find and remove corrupt files.

Link:<http://www.malwarebytes.org/>

[travelingtypist]

2. Thanks.

I've got a thread going here at the below link.

http://www.cybertechhelp.com/forums/forumdisplay.php?f=25

I posted a HijackThis log and they'll run me through combofix or gmer or whatever else if there's any corrupt files. There's about six instances of this virus where people weren't weren't as lucky as me that they're helping them get rid of it.

It shared the shit out of me.

[defendandprotect]

3. What the heck is "Antivirus Live" . . . Internet Explorer forced it on me ...

as I was changing AVG . . . which I was being told was infected!!!

Since Antivirus Live is on, the computer is better but I can't run the scan . .
something about ...
the htmlayout.dll not being found ... and a suggeted reinstalling the application to
fix the problem. To boot I've paid for this Antivirus thing so I could reach the
internet yesterday!

There's a 30 day cancellation --

[CK_John]

4. Direct from google:

Antivirus Live is a rogue antivirus application, fake spyware removal tool that enters a computer with the help or Trojans and other malicious.

getting rid of it:

<http://www.howtogeek.com/howto/8693/how-to-remove-antivirus-live-and-other-roguefake-antivirus-malware/>

[defendandprotect]

5. Thank you . . . sad news, but thank you!

I took a quick look at the instructions and obviously anything that I take into

my computer is immediately infested.

You need a second computer -- so all of this will take days to work on.

I was going to send for Bi-Defender when I noticed that they ship it to you.

When I first did this, I got a call from VISA Fraud Dept -- evidently because these

people are "out of the country" so it raised alarms with them, but they had no info

on the company. When I was blocked I should have just left the computer off until

I could get to a second computer to check. I've now cancelled my credit card -- and

since this was based on cancellation for refund in 30 days, hopefully I can get the

charges cleared.

I can't believe the time and aggravation we're all involved with in these issues!

How is all of this going on? Granted I know computers are hackable, but this is insane.

On the other hand, the Chinese have broken into the Pentagon computers at least 20 times

so I don't feel like the lone victim!!

:)

[defendandprotect]

7. So you're saying that Antivirus Live can be removed ... even from the hard drive????

Elsewhere you seem to suggest that if the hard drive is infected it's curtains???

[defendandprotect]

6. It infected my Internet Explorer, evidently --

google when I had it on -- and my AVG ... !!!

AVG was reporting the infection of it's own area --

and Zone Alarm as well!!

Or, these are fake reports from AVG?

It's like understanding what Hamlet or James Jesus Angleton/CIA were worrying about!!!

Where is truth?