Help. pls- AV 2008 Spyware

[Uncle Vinnie]

RE: My daughter's PC, Visa Home premium, running CA AV:

She saw a popup and downloaded Antivirus 2008.
This thing is torture.. I ran CA Anti-spyware repeatedly- it removes it, and
it keeps coming back.

I Googled and removed a few registry references/startup programs 'run',
etc - Antivirus, as well a few folders...

Still no luck.. the computer is crawling, freezing, and you can see the
screen refresh/redraw slowly....

If anyone could offer some advice and coaching, I'd greatly appreciate it..
I am not sure if it is all deleted, nor am I sure if I may have made a few
registry mods I should not have... as follows:

HKEY_CURRENT_USER\Software\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Antivirus"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
"3P_UDEC" (not found on my pc)

Thank you very much...

 

[David H. Lipman]

From: "Uncle Vinnie" <[email protected]>

RE:: My daughter's PC, Visa Home premium, running CA AV:

| She saw a popup and downloaded Antivirus 2008.
| This thing is torture.. I ran CA Anti-spyware repeatedly- it removes it, and
| it keeps coming back.

| I Googled and removed a few registry references/startup programs 'run',
| etc - Antivirus, as well a few folders...

| Still no luck.. the computer is crawling, freezing, and you can see the
| screen refresh/redraw slowly....

| If anyone could offer some advice and coaching, I'd greatly appreciate it..
| I am not sure if it is all deleted, nor am I sure if I may have made a few
| registry mods I should not have... as follows:

| HKEY_CURRENT_USER\Software\Antivirus
| HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Antivirus"
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
| "3P_UDEC" (not found on my pc)

| Thank you very much...
| --
| B'rgds,

| Vinnie




For more non-viral malware...

Please download, install and update the following software...

* Ad-aware SE 2007
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.5
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html



For viral and trojan malware...

* Download MULTI_AV.EXE from the URL --
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe

http://www.pctipp.ch/downloads/dl/35905.asp

English:
http://www.raymond.cc/blog/archives/2008/01/09/scan-your-computer-with-multiple-anti-virus-for-free/

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *

 

[Uncle Vinnie]

thank you David...


I will get started and report back!!

From: "Uncle Vinnie" <[email protected]>

RE:: My daughter's PC, Visa Home premium, running CA AV:

She saw a popup and downloaded Antivirus 2008.
This thing is torture.. I ran CA Anti-spyware repeatedly- it removes
it, and it keeps coming back.

I Googled and removed a few registry references/startup programs
'run',
etc - Antivirus, as well a few folders...

Still no luck.. the computer is crawling, freezing, and you can see
the screen refresh/redraw slowly....

If anyone could offer some advice and coaching, I'd greatly
appreciate it.. I am not sure if it is all deleted, nor am I sure if
I may have made a few registry mods I should not have... as follows:

HKEY_CURRENT_USER\Software\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"Antivirus"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
"3P_UDEC" (not found on my pc)

Thank you very much...

Vinnie

For more non-viral malware...

Please download, install and update the following software...

* Ad-aware SE 2007
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.5
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html



For viral and trojan malware...

* Download MULTI_AV.EXE from the URL --
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe

http://www.pctipp.ch/downloads/dl/35905.asp

English:
http://www.raymond.cc/blog/archives/2008/01/09/scan-your-computer-with-multiple-anti-virus-for-free/

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder
C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow
WGET.EXE to go through your FireWall to allow it to download the
needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in
C:\AV-CLS}
This will bring up the initial menu of choices and should be executed
in Normal Mode. This way all the components can be downloaded from
each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
Reboot the PC.

You can choose to go to each menu item and just download the needed
files or you can download the files and perform a scan in Normal
Mode. Once you have downloaded the files needed for each scanner you
want to use, you should reboot the PC into Safe Mode [F8 key during
boot] and re-run the menu again and choose which scanner you want to
run in Safe Mode. It is suggested to run the scanners in both Safe
Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *

 

[jen]

RE: My daughter's PC, Visa Home premium, running CA AV:
She saw a popup and downloaded Antivirus 2008.
This thing is torture.. I ran CA Anti-spyware repeatedly- it removes
it, and it keeps coming back.
I Googled and removed a few registry references/startup programs
'run', etc - Antivirus, as well a few folders...
Still no luck.. the computer is crawling, freezing, and you can see
the screen refresh/redraw slowly....
If anyone could offer some advice and coaching, I'd greatly appreciate
it.. I am not sure if it is all deleted, nor am I sure if I may have
made a few registry mods I should not have... as follows:
HKEY_CURRENT_USER\Software\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"Antivirus"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
"3P_UDEC" (not found on my pc)
Thank you very much...

How to remove Antivirus 2008:
http://www.bleepingcomputer.com/malware-removal/antivirus-2008

-jen

 

[Uncle Vinnie]

Thank you all!
All's fixed.. works fine!

How to remove Antivirus 2008:
http://www.bleepingcomputer.com/malware-removal/antivirus-2008

-jen