April 19, 2010

Not Protected After All: Antivirus Infections Strike Despite Your Security Software.

Filed under: Computer Performance, Fake Antivirus, Viruses, data recovery — Tags: anti-spyware, anti-virus, antivirus, Antivirus 2009, computer infection, computer recovery, computer security, data recovery, firewall, firewalls, Pro Antivirus, Safe mode, security software, Software, System Antivirus, Ultimate Antivirus, Vista Antivirus, Windows registry, Windows repair, XP Antivirus, XP Antivirus 2008 — admin @ 3:10 pm

You got your polio and whooping cough shots as a kid and you never came down with either of these dreaded diseases.

You might think that your security software on your computer works the same way. You took the preventative measures to avoid the infection, so you should be safe.

But, surprisingly, security software does not always provide the kind of protection to your computer that your childhood vaccines provide to your body’s immune system.

Your anti-virus/anti-spyware programs and firewalls can be made vulnerable through fake antivirus program scams that fool even savvy computer users.  The fake antivirus program scams arrived last year as “XP Antivirus 2008.”  It lives on in many variations, including “Antivirus 2009.” This scam is successful because it cleverly mimics Windows warning screens and legitimate antivirus programs. Virtually every legitimate antivirus company has a product called Antivirus 2009, so it’s no wonder so many computer users are confused–and duped!

Here’s how the infection scam works. You get an official looking popup warning or an e-mail message telling you that you are infected. To remedy the situation, you are instructed to click on a link that takes you to a website. Then you are told you need to download software.

As a result, you click on links that generate malicious code or downloads and runs questionable files. You will inadvertently override your own installed protection. In some cases, you will actually disable your protection programs! Even worse, the scam will make it look as if your protection programs are still running, so you will be none the wiser.

Any popup or error message that refers to Antivirus 2008 or 2009 (including System Antivirus, Ultimate Antivirus, Vista Antivirus, Pro Antivirus or XP Antivirus followed by a number) should be considered extremely suspicious. If you see any reference to a virus that is not specifically from the product that you have installed in your computer for protection, you should consider it a fake–and dangerous.

Windows won’t ever alert you of a virus infection.

Getting rid of the code once it has infected your system is quite involved. In our service business, we use a combination of several manual detection and removal processes, along with multiple scanning programs to recover your data. This ensures that all potential re-infection avenues (temp files, restore points, modified dll files, etc.) have been removed or restored. We routinely warn novices not to attempt this without help.

Depending upon how long and which version of the malware you have been infected with, you may also need to run a Windows repair after you remove the code. Certain Windows files become corrupted as a side effect.

If you know how to work with the Windows registry, operate in Safe Mode and have a current backup of your critical files, you should be able to find instructions online for removing the exact version of the infection that you have. If not, consult a tech savvy friend or a professional. Again, removing this infection so that you don’t re-infect is technically complex and not for the novice.