8 Replies Latest reply on Mar 8, 2010 9:12 PM by kquarter

    help destroy antivirus xp 2010

      Hi everybody,

       

      (I posted yesterday the same message, but in french. No answer. Forget it)

       

      I have renewed my Mcafee viruscan in january. Everything was alright.

       

      On monday 15th of feb, my PC computer has been invaded by a virus which names itself as "antivirus xp 2010". It pretends to scan your files, then pops many messages to alert you.

       

      I asked immediately my viruscan to update its data than to scan all my files. No infected file was detected.

       

      On the net, somebody had given the advice to seek then to stop an executable program named "AV.exe". I found it, stopped it and all the alert messages disappeared. I had to do it again regularly, but I could work.

       

      On wednesday 17th at about 12 o'clock, I asked my viruscan to update its data -obviously there were new ones available - then to scan all my files. Two of them were detected as infected. One of them was the "av.exe", I forgot the name of the other one.

       

      Viruscan automatically placed them in quarantine.

       

      But the result is worse than before.

       

      The alert messages don't appear anylonger. But I cannot launch executable programs like "word", "excel", "internet explorer", "windows explorer".

      Those programms are nevertheless still working, since I can launch them (the 2 first) by click on a data file recently used and calling these executables)

       

      Surprisingly, "outlook express" is still working more or less normally (internet connexion stops itself after a few minutes or seconds)

       

      What can I do??? Thank you for your (urgent...) help.

       

      (of course, I write this message on another computer)

        • 1. Re: help destroy antivirus xp 2010

          I still got no answer on my previous message

           

          May I ask to any Mcafee people if they still recommend to use their "FakeAlert Stinger" as described in message nr 110862?

           

          Thanks for any answer.

          • 2. Re: help destroy antivirus xp 2010
            dmeier

            Yes, please start by using the FakeAlert stinger, and make sure to go into Preferences and turn the heuristic network check  (Artemis) up to very high. (if you are more comfortable, you can set it to scan only, first, to make sure no legitimate files get flagged.)

             

            I would reboot after running the tool, and see how the system is behaving.  If it's still not quite right, then we'll likely need to look for additional samples.

             

            Let us know how it goes.

             

            - David

            1 of 1 people found this helpful
            • 3. Re: help destroy antivirus xp 2010

              Thank you, David, for your answer.

               

              I loaded your FakeAlertStinger - by the way, version 10.0.1.758 - on a safe computer, transfered it on an USB key, than on the desktop of my ill computer. I solved the problem to launch Stinger with a right click and "start" order.

               

              I scanned all my files with the two options simultaneously: "report" and "very high sensitivity". No infected file has been detected by Stinger. It seems that the scanning made with Mcafee normal procedure with updated data (see my first message) has cleaned properly the files.

               

              Unfortunately, as I say in my first message, two of them have been put in quarantine during that normal procedure. The first one is the AV.exe, the virus, but the second is probably - sorry, I made the huge mistake not to write its name - an infected Windows file. Now, I cannot launch normally any executable program (Excel, Word, Works, ... but also Mcafee security center, Windows explorer, Internet explorer...). I rebooted after Stinger scanning: no change in this problem - no change at all in fact.

               

              Do you know or guess what is this second file (name and location in Windows files) so that I can try and find somewhere a clean one to reinstall it in its correct location?

               

              Another possibility is that the second file in quarantine has to be destroyed, but that one or several Windows files have been damaged. Do you know a way to check that point?

               

              Thank you very much.

              • 4. Re: help destroy antivirus xp 2010

                I have the exact same problem.

                 

                Now, I cannot open Word, Excel, and many other applications.

                 

                Does anyone have an idea what to do now?

                 

                Thanks!

                • 5. Re: help destroy antivirus xp 2010

                  I did have the same problem after I made changes to my registry as a result of this thing. I was able to get all my .exe (executable) files working again including MS Office products. You need to create a new file association in control panel.  Go to control panel/folder options/files types and the under registered files types you need to create a new type. When the window appears type in exe and click on the advanced button and choose a file extension type of application and then select yes when prompted. I hope this helps it totally resolved my issue on 2 different PC's.

                   

                  Good Luck,

                   

                  Darren

                  • 6. Re: help destroy antivirus xp 2010

                    I had the same problem a while back also... It seems to me that the source of the antivirus xp 2010 pop up is the Generic Artemis! (trojan) which downloads other trojans and hijackers on its own... it also lock functionality of virus scan software detection and in my case blocked my ability to double click on programs in order to open them.. (i have to right click and select start)... I found a way to fix it though i'm unsure if it's a permanent solution given that after fixing it.. a month later... I got the same virus again except this time my method to fix it isn't working.. (I think i got the trojan from a website i visit frequently to watch anime cartoons, bleach, thus i think that after solving the problem i visited the site again and got the virus again) I have Mc Afee thru my ISP and I don't have to pay a monthly subscription..  but I have to say... Mc Afee your software sucks.. it is completely useless for "real" trojans and viruses.. Mc Afee doesn't even detect this trojan anymore.. I downloaded two free anti-malware softwares that seem to work fairly well (at least better than mc afee).. Malwarebytes and Super Antispyware...

                     

                    here's what i did to fix my problem the first time..

                     

                    it seems that the Trojan source file is a *.Dll file stored in the windows 32 folder.. and it can't be deleted manually..

                     

                    1. First ran Super Antispyware did a complete scan...

                        surely enough it detected several threats including the Artemis!

                    2. Follow the instructions for removing the threats as described by Super Anti-spyware

                        this will erase the infections for a short period of time.. but not the Artemis!

                    3.disable automatic restore points on windows..

                    4. shutdown computer and restart on safemode (non networking)

                    5. Install Malwarebytes and run a complete virus scan

                    6. At this point you should get the Artemis! trojan detected and a few more other malware..

                    7. Malwarebytes has the option to erase!.. the trojan.. follow instructions and shut down the computer right away..

                    *** the last part involves knowledge of the Registry files and how to edit them correctly***

                    ***warning** modifying the registry can also affect the fuctionality of your system**

                    Malwarebytes report should have provided you with a resgistry address or at the very least the name of the source file..

                     

                    8. while on safemode...simply access the system registry and erase the file...

                     

                    this fixed pretty much every issue i had and for a good while i had no noticible problems on my pc.. 

                    • 7. Re: help destroy antivirus xp 2010

                      Thank you very much, Darren, for your trick.

                       

                      I was close to erase everything in my computer. I tried and it worked perfectly. Apparently there is no problem remaining in my computer.

                      • 8. Re: help destroy antivirus xp 2010

                        Hi Darren,

                         

                        THANKS! This worked for me as well. My computer is feeling a lot better now.