cancel
Showing results for 
Search instead for 
Did you mean: 

Re: If you have Fake AV Software showing up on your system, read this

Just different spyware that I searched and downloaded, but my downloads don't seem to be working.  I copied the stinger from work onto flash drive, installed, ran and the virus seems to be gone.....thankfully.  Now, my downloads still won't run and now my control panel does not work.  When I click on an item in the Control Panel, I get the following popup:  C:/Windows/system32/rundll32.exe    Application not found.  And that's it.  I can get on to internet, but it does open a window that asks what I want to use to open it, which I pick Firefox to open Firefox, etc.  It gives me something about an error, which I have just closed because I can see it opening in the background.  I am just leary that the virus is still lurking.  Anyone experiencing any of the above after running the stinger and what was the fix?  Thanks for the help...

Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 82 of 98

Re: If you have Fake AV Software showing up on your system, read this

Try it in "Safe Mode wiith Networking" reached by tapping F8 while booting up.  MBAM is fully functional in this mode.

Re: If you have Fake AV Software showing up on your system, read this

if this is the same problem discussed in another thread "AV.EXE" there is more to it... Even though McAfee quarantined the virus, I am having the same problems because it also screws up the registry. So there are problems in the registry that need to be repaired. check this thread

Re: av.exe removed by McAfee now all *.exe files do not launch

Re: If you have Fake AV Software showing up on your system, read this

I switched from Norton to McAfee a few years ago as Norton was a real memory hog.  I haven't compared them side-to-side any time recently.

The fakealertstinger solution worked for me today for the Antivirus XP 2010 fake antivirus malware.

As instructed, I turned off my System Restore, rebooted, ran fakealertstinger with preference set to Very High sensitivity.

I also had the same problem after running the fakealertstinger -- In that my .exe didn't work - my rundll32.exe couldn't be found, etc.

My file associations were all screwed up.

I was able to get on the internet and Google for a solution and made it to Doug Knox's Windows 95/98/Me/XP/Vista Tweaks and Tips website at:

http://www.dougknox.com/

I use Windows XP, so I clicked on the "Windows XP Fixes" on the left.

Then I clicked on "File Association Fixes"

Then I clicked on "EXE File Association Fix"

That downloaded the ZIP file.  I then unzipped it, then double clicked the "xp_exe_fix.reg" file, and then EVERYTHING WORKED PERFECTLY.

I have rebooted, rescanned, rebooted, rescanned - I am free of the Antivirus XP 2010 evil, and the glitches caused by the fix.

The direct link to the Windows XP fix for me was: http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip

Jeff in Florida

Message was edited by: indymag on 2/27/10 2:34:33 PM CST

Re: If you have Fake AV Software showing up on your system, read this

Not to muddy the waters at all here, and to try and be fair to the McAfee guys...

   In the original post almost a month ago (well, second post actually. See the 9th entry in this thread from Brian Mann.) where the link to the "Stinger" was presented, the instructions specifically stated to turn off the "System Restore" AND to change the "Preferences" setting in "Stinger" to HIGH. (NOT "VERY HIGH" as everyone has been speaking of recently!)

It is possible that the "Very High" setting in "Stinger" is causing the problems with disruption of the "rundll32.exe" - " *.exe " - and "Control Panel" problems. When I did my repair earlier I used "Stinger" in the HIGH preference and did not have these problems after using the repair on three different machines (2 XP and 1 Vista). The only problem I did see was that I was unable to go into the "Display Properties" - "Desktop" tab and return the wallpaper to a selection of my own on one of the XP machines. "Stinger" blanked out the "FakeAntiVirus's" green wallpaper during the repair. I asked for clarification on this issue and did not receive a response, but it really is not a big issue. I just have not taken the time to check further on it anywhere else.

You need to be aware of and heed ALL of the instructions as posted by the McAfee techs on this site before running any repair.

And a couple good alternate suggestions here from "Coopster" and "indymag" - Thanks!

Message was edited by: Art Nels on 2/28/10 8:36:04 PM CST
mike55
Level 7
Report Inappropriate Content
Message 86 of 98

Re: If you have Fake AV Software showing up on your system, read this

Question.  I have a machine where fake av (in my case - it calls itself "Vista Defender 2010" is running on one login (my son - a restricted user).  I was going to download the stinger but figured that I would try malwarebytes first (I have it running on two other machines) after seeing it mentioned here.   In either case - can I run the stinger or malwarebytes from my login (admin) and remove fake av?  Do I need to do anything else specific with malwarebytes to maximize the chance that it will be detected and removed?

I THINK I HAVE THE ANSWER!!!!

Here's the deal:

I have now removed this virus from 5 machines - our two, my mother's, and two friends.  Very little of what Mcafee has done has been all that helpful, including the 90 dollar fix.

As an aside, I fully get that many companies offer paid removal services (as pointed out by Ex_Brit); my bigger issue was Mcafee's refusal to stand behind their work.

DO not waste your time with the Stinger; it's marginally effective at best.

Having said that - here is what I did on all 5 machines, with great success:

1.  Run a system restore.  Not from restore points; the one from startup that basically takes you back to day one.  Files (pics, docs, etc) will remain intact.

2.  Download and run MBAM.  I recommend doing it twice, set to "full scan".

3.  Either pay the 24.95 form MBAM's preeventative service, or use Ad-Aware's free service.  Both are effective.

That's it.  Simple, effective, and low cost.

Additional note:  My ISP dumped Mcafee for Norton.  Norton is consistently picking up attempted attacks, where I never recieved a single notification from Mcafee - except for the ones where it told me I was infected with something they couldn't do anything about.

Good luck everyone!


on 2/27/10 10:47:55 AM CST
qdwyer
Level 7
Report Inappropriate Content
Message 88 of 98

Re: If you have Fake AV Software showing up on your system, read this

My experience is that you have to run it in the infected account or it does not find the files. I hope I am wrong because I have the same circumstance and it would be easy to run it form a non-infected account. Has not worked for me so far.

Highlighted

Re: If you have Fake AV Software showing up on your system, read this

I also have the fake anti virus software on my computer.  I contacted Mcafee they told me I had a choice to either pay them and have them remove it or run the stinger.

The only symptoms I have (that I know of) is my Mcafee icon in my right lower hand panel says Mcafee is not protected and keeps telling me to "fix" the problem or renew subscription. I also receive the popups from the AV software about once a week telling me I am at risk. When I exit the pop up it runs a fake scan on the computer. I think it is Internet Security Vista 2010 and another program.

I downloaded malwarebytes and it is not detecting anything. Nor is mcafee virus scan.

I also ran the fakeavalert stinger in this post and it did not detect anything also. I ran it in very low setting though. Is there a setting that I am supposed to be running it on with out messing my computer up?

Please Help me. My computer seems ok but I don't want it to get out of hand like others in this post. I don't have additional money to pay Mcafee to fix it.

Thank you

Re: If you have Fake AV Software showing up on your system, read this

If you are worried about Stinger messing up your computer, set On virus detection

action to Report only for the first scan. Then scan with High or Very High settings, and post the results here.

This way, Stinger will only detect but not change anything on your machine.

Irene

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community