XP Antivirus 2008

[ddrueding]

Just a dumping ground for information on this sucker. I don't know if you guys are having to deal with it as much as I am. Looking for the fastest, most complete free removal method.

Information:

Precise Security

Bleeping Computer

Has anyone used this Malwarebytes' Anti-Malware that is mentioned? Does it work?

 

[Mercutio]

Generally speaking if there's no known fix for a malware program but something completely untrusted/unknown, I'll take a chance on it. The machine is already infected, after all.

 

[Bozo]

It seems to me that CCleaner removed XP Antivirus 2008 for me.

Bozo :joker:

 

[MaxBurn]

This thing is out there quite a bit, I have encountered it several times in the past week alone. So far I just clicked no on the save/install file prompt.

 

[ddrueding]

Has anyone used this Malwarebytes' Anti-Malware that is mentioned? Does it work?

This worked great. Install, update, full scan, delete.

 

[CougTek]

I used Malwarebyte on a system infected by both Antivirus XP 2008 and Brave Sentry. After the scan, the machine refused to boot in Windows. I had to repair Windows. After the repair, XP 2008 was gone. Brave Sentry is best removed by Smitfraudfix.

I recommend backing up the data or making an image of the drive before attempting to clean this infection (and many others).

 

[ddrueding]

Thanks for the tip CougTek.

 

[MaxBurn]

I haven't seen this stuff in a while but today I stumbled on this writeup and nice walk through on XP antivirus:

http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/

 

[jtr1962]

I've had this, XP Antivirus 2009, and I think MS Antivirus 2008 pop-ups more in the last week than ever before. It seems the SOBs are really persistent. And nothing seems to be able to prevent these pop-ups from happening despite using Spywareblaster, Spybot S&D, and AdAware. The only safe way to kill them so they don't install malware is to kill the entire IE process in Task Manager. So far nothing in Opera, but I really hope they get to the bottom of whoever is doing this, and give them a vacation in ClubFed.

 

[ddrueding]

Joe, if you use IE, you deserve what you get. Really, you do know better. I have never, ever, seen one of these pop-ups, because I only use Firefox.

 

[Mercutio]

MSRT actually does something useful, possibly for the first time in history.

 

[MaxBurn]

Heh, you think they did something to address the bad press?

 

[LunarMist]

I am unsure about this. My XP SP2 does not have any antivirus. Does the MS patch add the XP antivirus protection, or is the XP antivirus the undesirable part?

 

[ddrueding]

There is a virus called "XP Antivirus 2008". It is not microsoft software of any kind. That is part of the trick. XP comes with a firewall, but not AV.

 

[MaxBurn]

It's just malware with a name to fool the computer illiterate, and it is frankly shocking how successful a simple name and some looks are at passing these things off in this day and age.

 

[LunarMist]

OK. I won't bother with it then. I never get any viruses or malware anyway.

 

[MaxBurn]

Crap, I think my parents laptop has this. This is a root kit right? Deleting the partitions will get rid of that you think?

 

[LunarMist]

You could rewrite the MBR too if that is a concern. Are there no restore disks or images?

 

[MaxBurn]

Regular old fdisk /mbr you think would do it?

No backup of this machine available, only thing I have is the sticker on the bottom.

 

[MaxBurn]

Regular old fdisk /mbr you think would do it?

No backup of this machine available, only thing I have is the sticker on the bottom.

 

[Bozo]

I don't believe it is a root kit. It is a scam to get money even though there is nothing wrong with the computer.

Microsoft Security Essentials should clean it out, and it is free!

 

[ddrueding]

MSE will do it, and so will malwarebytes.

 

[CougTek]

Combofix is also quite effective against it. Available here. Run it in safe mode with network access. Only on a Windows XP system though, not compatible with Vista/Win 7.

 

[ddrueding]

I was going to mention Combofix, but couldn't remember the name. Changing the name of the executable may also be required (I recommend somethingrandom.cmd.

 

[MaxBurn]

I must have had xp antivirus plus something else then because whatever it was disabled exe or any other type of executable files. Disabled task manager and just made the machine completely useless. I know the registry keys to fix the exe thing but I was looking around on the net for a way to edit the registry offline (couldn't run regedit.exe) with the limited tools I had when I realized I don't need this on my vacation, especially when I know I can provide a much better solution if I take it home, nuke it and do a fresh install.

 

[Mercutio]

I know the registry keys to fix the exe thing but I was looking around on the net for a way to edit the registry offline (couldn't run regedit.exe) with the limited tools I had

Even if running .exe files has been disabled, you can still run command.com. So start that up and use the command prompt to run Firefox or notepad or the registry editor if you need to do so.

 

[MaxBurn]

I know I tried cmd several times but I don't think I tried actual command.com. That's a nice tip.

 

[Howell]

I combofix renamed to 123.com and set to read only as sitting on my thumbdrive.

 

[ddrueding]

Ran into a nasty variant last night. Had to rename the file, run the registry patch, run combofix and malwarebytes from safe mode, then manually delete the folders before reboot.

 

[MaxBurn]

I nuked it from orbit, I felt it was the only way to be sure.

She should have it in hands today if not already.

 

[LunarMist]

I nuked it from orbit, I felt it was the only way to be sure.

She should have it in hands today if not already.

Aliens?

 

[Mercutio]

Little known fact: Aliens and Blade Runner seem to take place in the same universe, based on subtle hints like the fact that characters in each smoke the same brand of fictional cigarettes.

 

[MaxBurn]

Damn, I didn't notice the cigarettes part. Both really cool movies in my book.