The Fake Antivirus/Anti-Malware Threat

Rogue antivirus, anti-malware has been around for quite sometime, there are quite a number of different varieties of this type of fake antivirus, anti-malware out there ready to infect a unprotected computer. Malware like Antivir 2010, Antivirus Pro 2009 and Antimalware Doctor are rogue antivirus/malware programs that are promoted through the use of fake online antivirus/malware scanners. When browsing the web you may see a pop up that states your PC is infected. If your PC has been infected you should remove the infection it immediately with a reputable anti-malware program,

There are quite a number of different varieties of this type of fake antivirus, anti-malware out there on the web, below is a small list of a few you might encounter if your unlucky too.

Antivir 2010
Protection Center
Antimalware Doctor
Antivirus Pro 2009
XRJ Antivirus and Sysinternals Antivirus
Win Antispyware Center
AKM Antivirus 2010 Pro and Antimalware Doctor
SystemArmor, Live Security Suite and A-Fast Antivirus
ByteDefender Security 2010

 

How The Fake Antivirus/Anti-Malware Threat Works

The Fake Antivirus/Anti-Malware is a rogue that is promoted through the use of fake online anti-malware scanners, when browsing the web you may see a popup that states your computer is infected and that you should run an online anti-malware program to scan your computer for infections. If you click on this popup you will be brought to a site that shows an advertisement that pretends to be an online anti-malware scanner. At the end of the advertisement, it will state that your computer is infected and that you should download and install Antivir to protect your computer. When Antivir is installed it will be configured to start automatically when windows starts, once started it will scan your computer and list numerous infections on your computer, but will not allow you to remove them until you purchase the program.

The reality is that the infections it finds are legitimate programs that should not be deleted as it may cause your computer to not run properly. When Antivir is running it will display numerous fake security alerts in windows on your computer, these alerts will state that Identity theft is occurring or that an infection has been detected. This program will also hijack Internet Explorer so that when you are browsing the internet you will be shown an About:Blank page that states that the site you are visiting can harm your computer, just like the scan results these security alerts are all fake and should be ignored. Please do not purchase any programs or licences, or act on any of the scan results that are shown by it.

Screenshots of various Fake Antivirus/Anti-Malware

 

Using Ctrl+Alt+Del On Your Keyboard

 

When you try to close the rouge program by clicking on the X, it either wont or just reappears again, usually at that point most people will get so frustrated that they will just do whatever the program is asking them to do, and that usually involves money.

So here are a tip to get back on your feet, Press Ctrl+Alt+Del on your keyboard, if your lucky and the malware hasn't disabled it you should see the Task Manager panel. Click on File in the Task Manager Panel and then New Task (Run) and type the word explorer, after clicking on the OK button you should have your Desktop back, once there you are good to run your favorite antivirus/antispyware program and get rid of the malware on your PC. This method only works if the malware has not disabled functions like Task Manager or other programs on your PC.

 

Remove Fake Antivirus/Anti-Malware Using Malwarebytes

Malwarebytes Anti-Malware is available in both a free and Pro Edition, the free edition must be run manually while the Pro version can automatically perform scheduled scans. The paid version adds real time protection to your computer as well.

Screenshot of Malwarebytes Anti-Malware software

1. If your current antivirus solution let this infection through you should download Malwarebytes Anti-Malware software.
2. Close all programs and opened windows on your computer.
3. Double click on the icon on your desktop named mbam-setup.exe.
4. When the installation begins keep follow all the prompts in order to continue with the installation process.
5. MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan.
6. On the Scanner tab make sure the the Perform Full Scan option is selected and then click on the Scan button to start the scanning of your computer for Antivir, Antivir 2010, and Antivir Antivirus related files.
7. MBAM will now start scanning your computer for malware, this process can take quite a while.
8. When the scan is finished a message box will appear.
9. You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
10. A screen displaying all the malware that the program found will be shown.
11. You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and adds them all to the programs quarantine.
    

Your computer should now be free of the fake antivirus, anti-malware program, if your current anti virus solution has let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.