When is an antivirus really a virus?

Today I recei­ved a call from one of my exter­nal users that was una­ble to access any web­si­tes because some new anti­vi­rus was saying he was unpro­tec­ted and every web­site had mali­cious code.

Since I know that we have McA­fee 8.5 deplo­yed to our users, I knew that this was not a McA­fee issue.  As we dis­cus­sed it a little further he was men­tio­ning that the Anti­vi­rus wan­ted him to purchase the software.

This isn’t the first I have heard of this.  There is a soft­ware com­pany Inno­va­gest 2000 that is pro­du­cing this soft­ware.  They adver­tise it as an antispy­ware appli­ca­tion, but it is the spy­ware.  On some less then savory web­si­tes you will get a pop up that says that your com­pu­ter maybe infec­ted and they offer a free scan.

The fear of being infec­ted moti­va­tes a lot of peo­ple to run this free scan.  Unk­nown to them this appli­ca­tion ins­talls under­neath and now you are stuck.  On that note, I do recom­mend only doing the online scans from repu­ta­ble sites.  I per­so­nally recom­mend the follo­wing: Syman­tec, Panda, and McA­fee.

This appli­ca­tion is extre­mely hard to get rid of.  It rere­gis­ters and ins­talls if it is not com­ple­tely unins­ta­lled correctly.

I hate pro­grams like this.  But it is a fact of life out there.  The modern day snake-oil salesman.

While the pro­gram is run­ning you will see the follo­wing unde­si­ra­ble behavior:

• A “Win­dows Secu­rity Cen­ter” sta­ting that you should purchase Per­so­nal Antivirus.
• Nume­rous alerts sta­ting that your com­pu­ter is under attack or that you have mal­ware run­ning on your com­pu­ter. If you click on these alerts, Per­so­nal Anti­vi­rus will be ins­ta­lled, or you will be brought to the purchase page for the program.
• Your Inter­net Explo­rer brow­ser will be hijac­ked to show secu­rity war­nings when brow­sing the web that stop you from reaching your desi­red page.

As I men­tio­ned before this bug­ger is very hard to get rid off.  But not impos­si­ble.  I found these ins­truc­tions at BleepingComputer.com.

1. Print out these ins­truc­tions as we will need to close every win­dow that is open later in the fix.
2. Down­load Mal­wa­reby­tes’ Anti-Malware, or MBAM, from the follo­wing loca­tion and save it to your desk­top:
   Mal­wa­reby­tes’ Anti-Malware Down­load Link
3. Once down­loa­ded, close all pro­grams and Win­dows on your com­pu­ter, inc­lu­ding this one.
4. Double-click on the icon on your desk­top named mbam-setup.exe. This will start the ins­ta­lla­tion of MBAM onto your computer.
5. When the ins­ta­lla­tion begins, keep follo­wing the prompts in order to con­ti­nue with the ins­ta­lla­tion pro­cess. Do not make any chan­ges to default set­tings and when the pro­gram has finished ins­ta­lling, make sure you leave both the Update Mal­wa­reby­tes’ Anti-Malware and Launch Mal­wa­reby­tes’ Anti-Malware chec­ked. Then click on the Finish button.
6. MBAM will now auto­ma­ti­cally start and you will see a mes­sage sta­ting that you should update the pro­gram before per­for­ming a scan. As MBAM will auto­ma­ti­cally update itself after the ins­tall, you can press the OK but­ton to close that box and you will now be at the main program.
7. On the Scan­ner tab, make sure the the Per­form quick scan option is selec­ted and then click on the Scan but­ton to start scan­ning your com­pu­ter for Per­so­nal Anti­vi­rus rela­ted files.
8. MBAM will now start scan­ning your com­pu­ter for mal­ware. This pro­cess can take quite a while, so we sug­gest you go and do something else and perio­di­cally check on the sta­tus of the scan.
9. When the scan is finished a mes­sage box will appear. You should click on the OK but­ton to close the mes­sage box and con­ti­nue with the Per­so­na­lAn­ti­vi­rus remo­val process.
10. You will now be back at the main Scan­ner screen. At this point you should click on the Show Results button.
11. A screen dis­pla­ying all the mal­ware that the pro­gram found will be shown. Please note that the infec­tions found may be dif­fe­rent than what is shown in the image.You should now click on the Remove Selec­ted but­ton to remove all the lis­ted mal­ware. MBAM will now delete all of the files and registry keys and add them to the pro­grams qua­ran­tine. When remo­ving the files, MBAM may require a reboot in order to remove some of them. If it dis­plays a mes­sage sta­ting that it needs to reboot, please allow it to do so. Once your com­pu­ter has reboo­ted, and you are log­ged in, please con­ti­nue with the rest of the steps.
12. When MBAM has finished remo­ving the mal­ware, it will open the scan log and dis­play it in Note­pad. Review the log as desi­red, and then close the Note­pad window.
13. You can now exit the MBAM program.