Comments on: How to Remove XP AntiSpyware

By: lgforbes

lgforbes — Sun, 18 Apr 2010 16:47:51 +0000

Do *not* pay for this, especially with a credit card. For those folks who have already done so, it probably wouldn’t be a bad idea to cancel those cards. (See link below.)

To safely get rid of such crap, there is lots of very good, effective advice, this site included. Cry for help — use a friend’s computer or go to the public library if you have to — and you’ll get it.

Things can get worse:
http://news.bbc.co.uk/1/hi/technology/8622665.stm

Keep up the good fight, Gina et al!

By: philmiller

philmiller — Thu, 15 Apr 2010 02:01:52 +0000

I too am wondering if anyone knows of what happens after someone falls for this and pays the $70. I will be using the hints here to help a friend friend tomorrow to remove this. They paid the money and even spoke with someone from “customer support”. I will update here after I go through the process and am not on my phone.

By: Gabriella Arroyo

Gabriella Arroyo — Mon, 12 Apr 2010 00:02:03 +0000

HELP!
Do you know anyone who actually fell for this scam and bought the Antispyware protection?? thats what my mother did and she paid 80 dollars with her credit card!
Will she get her identity stolen? We just called the bank what else can we do to prevent this??

By: gmf

gmf — Sun, 04 Apr 2010 11:44:23 +0000

I contacted their customer service to remove this from my computer and they emailed me to set my calendar ahead 8 days, then in 8 days to reset my calendar correctly. Supposedly the program expire and delete itself after 8 days. The other options were to not use your computer for 8 days or download one of their programs for removal ???? Yeah…right!! I have not tried this because of already going through the process of stripping my computer with the original software and restoring this way. Next time I will try the above method first, I have run across this program before and been able to get rid of it more easily than in this instance.

By: Andreas Schneidereit

Andreas Schneidereit — Thu, 01 Apr 2010 17:35:17 +0000

Gina, great story and reminder to all of us. I do light office work and some computer nerd duties at a small screen printing company when they need a little extra help. I went in one day and there was a new anti-virus on the computer asking to be updated. Since I had installed the anti-virus, and anti-malware software on the computer it totally confused me and stopped me from clicking the “OK” button. I asked the business owner if he had installed a new anti-virus and he told me “no”. Like the rogue program on your friend’s computer It too would pop up a screen with a false list of problems after a “scan”. The more I tried to clean it out using my old tried and true methods, the worse the computer ran until it was completely unusable. I booted into safe mode, found and removed the executable, then I was able to reboot and download Malwarebytes. It cleaned the computer of any remaining traces of the rogue anti-virus. It was a truly frustrating, yet satisfying experience.

I was unable to find out how the rogue program made it on the computer, it was running Windows firewall, AVG, and Spybot S&D. My only guess is somebody was visiting porn sites.

By: Miguel Wickert- Pineiro

Miguel Wickert- Pineiro — Thu, 25 Mar 2010 03:18:32 +0000

Great timing Gina, this article helped saved my father-in-law to be, computer. Seriously, this is huge, it helped me completely turn everything around. Some similar issues in both our situations. All is well for now.

By: adventurejason

adventurejason — Tue, 23 Mar 2010 23:52:35 +0000

Yet again, Gina, you’ve proven yourself one of the true superstars of the Internet, social media and the information age. Rock on.

By: shri

shri — Tue, 23 Mar 2010 06:56:44 +0000

Funny, I encountered this one yesterday on a fully patched XP system with F-Secure for Workstations on it. Beats me how it got in.

I solved it by running the Taskmanager as another user with administrative rights, killed the .exe proccess that the spyware consists of and upgraded the Anti-Virus to include proccess control, browsing protection etc. Works fine for the moment but I guess I should check those registry entries!

By: ZLoether

ZLoether — Mon, 22 Mar 2010 22:06:43 +0000

Most computer users, including IT professionals, will do whatever they can to not have to reinstall an operating system. Run anti-virus software, remove the virus. That might fix that problem, but how can you really be sure?

Once a computer it has been comprised, it can NEVER be trusted again, at least not until all connected hard disks have been wiped and the operating system reinstalled.

It is the clever intruder who installs two pieces of malware, one is obvious to draw your attention, and one is silently logging your keystrokes.

By: Jonathan Shan

Jonathan Shan — Mon, 22 Mar 2010 20:47:59 +0000

I work at UC San Diego’s Residential Networking, we do free viral removal for all UCSD affiliates, here’s our process:

1. Run Hitachi’s Drive Fitness Test (DFT). About 30% of the time, people have failing hard drives so it’s always best to check before spending a good deal of time manually cleaning a computer only to find out the work was in vain and the computer has hardware issues. If it fails, we call up the customer, have them purchase a new hard drive, and reinstall the OS for them using the COA on the bottom of their laptops, and pull the data from the old hard drive (this is all done with a fresh copy of Microsoft Security Essentials and the latest service packs on their machine so their computer isn’t reinfected.. If the test passed, we go on.

2. F8 into Safe Mode with Networking
3. Our network runs through a firewalled server with tools we download and run.
4. Run rkill.com to remove any active processes.
5. Run combofix, it sometimes takes more than once to run
6. Check the logs for missed things and manually remove files
7. Run CCleaner to remove any malware hidden in temp folders.
8. Run Autoruns to remove malicious startup entries
9. Run Process Explorer to see if any malicious processes are still running, and if there are any dll hooks from malicious programs.
10. Install and run Malwarebytes Anti-Malware full
11. Install and run Microsoft Security Essentials.
12. Verify with Autoruns/process explorer (to make sure its all gone).
13. Update programs with filehippo or ninite.
14. Install the latest service packs.
15. Give the customer a detailed description of how to stay safe and avoid reinfection.

Obviously this is the bare bones of what we do, we add on any necessary registry hacks and networking fixes on a case-by-case basis.

Hope that helps.