Fake AVG 2011 virus

[Syzygys]

The kid managed to get his first real virus. It was a rather tricky one, because it looked like the well loved AVG giving you notifications about viruses on your system and wanting a subscription fee.

The obvious giveaways were:

1. I couldn't turn off Fake AVG.
2. It keep popping up interrupting everything.
3. No browsers were working.
4. The cost what they asked was too much. AVG is $35 and they wanted $80.
5. I already had AVG on the computer and now we had 2.
6. Even stopping it with Task Manager didn't work.

So these are symptoms what you might want to watch for if something is suspicious. I googled "fake AVG 2011" and there were plenty of sites describing the solution. One important thing:

You don't need another anti-virus program (most likely for a free) you can get ride of it manually. The most important thing was to find the .exe file and rename it, once it was done, the virus finally stopped giving warnings. Then I had to delete a couple of program files, shortcuts and make sure the browsers worked again and that was it. Takes about 10-15 minutes... Well, you do need 2 computers because the one with the virus won't connect to the internet.

I share this in case some of you run into the same problem...

Here is a link to the removal process:

http://www.removevirus.org/fake-avg-antivirus-2011

One extra thing learnt: I ran the paid version of AVG once the virus was stopped and it didn't get ride off all of it. I had to do the manual removal...

[cosmictraveler]

I've always used Trend Micro to clean out any viruses that my "normal" anti virus" didn't stop. It is a free service and never once gave me a problem.

http://free.antivirus.com/clean-up-tools/

[MacGyver1968]

Yeah...there's a whole slew of fake anti-virus programs out there. Some of them can be really nasty to get rid of. I had one on a customer's machine that blocked the task manager, cmd line, windows explorer, and blocked a bunch of real anti-virus programs from starting. I usually use "combofix" to get rid of them, but it blocked it too. Fortunately I found if I renamed "combofix.exe" to "somethingelse.exe" it ran, and got rid of it.

It's a total scam. If you do buy into their offer, in some cases they won't just charge you $80...they'll sell you a bunch of stuff you didn't order and hit your card for $300+.

[Syzygys]

What I don't get why the NSA or other government agency don't go after these people? After all, the card is charged, it isn't that hard to find them, even if in other countries...

Cosmic, your solution only applies to people with common sense, not to college kids who don't know anything about computers.... I expect to reinstall the whole system a few times in the upcoming months.

I consider myself lucky with this one and hopefully he did learn a lesson, but I don't hold my breath....