Antivirus XP 2008 can only be removed by a fresh install!

General Topics
1

Hi malware fighters,

On a lot of web forums you can read how to manually uninstall fake software like Antivrus XP 2008 (and even Antivirus 2009) , a lot of users forget the fact that during the infection their OS already has been compromised and for these instances only completely formatting your hard disk and a fresh reinstall of the OS will restore a secure computer environment. When such a thing occur firms will isolate their infected machines, survey them and do a fresh and complete install. Many users do not realize the consequences of some infections.

The problem is that you cannot be sure what the malware did/has done to your system and to what an extent. In the case of Antivirus 2008 the scareware is being spreaded by botnets, You may have uninstalled the scareware, the bot-infection is a still there, and before you know it new malware can be forwarded onto your machine. Read here: http://www.marshal.com/trace/traceitem.asp?article=724

Do not hobby with a manual removal routine, but choose a complete format, it is easier than one thinks, read: http://lifehacker.com/software/windows/geek-to-live-how-to-format-your-hard-drive-and-install-windows-xp-from-scratch-157578.php

Friends, I got the above info on a Dutch security forum. Do our members think, I think of the ASAP people here like Oldman and Essexboy and others, that with decent analysis tools the cleansing of an infected system can be done profoundly (DDS-Comboscript- Hijackthis- Run Scanners etc.) or do we throw the glove into the ring and say aloud: “Hands up to the malcreants, the only escape is a total format”. I think there is always room for a system restore (if a date of infection is known) and non-compromised data backup returns should help,

Your friend, polonus like to hear the views of the experienced malware fighters on this matter?

polonus aka Damian

2

Hi, even easier is to restore a good image. There are free imaging programs available such as paragon drive backup express, acronis. :slight_smile:

3

I feel it is a total over reaction, a reformat is a final course of action and not a first choice solution.

Yes it may be a pain in the rear to resolve, but antivirus2008 is certainly not the big deal they are making of it, there are many tools to combat it. Whilst antivirus2009 is proving more problematic there from being zero information and solutions to clean this situation is improving.

A lot also depends on what else comes down the pipe with it, rootkit to hid and protect it, backdoor botnet, etc. so you may have to fight it on two or more fronts. But it shouldn’t be impossible.

The question is how long is it going to take to remove it manually or with tools over how long it would take to reformat and start from square one again. When I bought this new system, it came with XP Pro SP3 installed and absolutely nothing else, it took me almost 5 days (almost non stop) to get this new system set-up with all the software tweaks and settings, etc. as my old one. This would have been even worse if I had to go on-line with the new system requiring service packs or security updates, etc. you would stand really good chance of getting reinfected.

So the reformat option is a serious option of last resort.

If a user has a competent back-up and recovery strategy then they need never have to go down this route.

– SYSTEM BACK-UP & RECOVERY
If you fail to plan, then you plan to fail.
If you have a back-up and recovery plan, you can recover from anything in minutes, not hours or days.

  1. back-up all the things that you don’t want to lose, data files, like documents, spreadsheets, emails, email account details, registration keys, address book, favourites/bookmarks, downloaded files/programs, etc. the list goes on and on but if you don’t want to lose it back it up. There are many back-up programs that can simplify this task and run it every day.

  2. Recovery - re-installing your system really is a poor choice and one of last resort. There are tools (Drive Imaging software) that take exact images of your Partitions or Hard Disks and these images can be restored in minutes if you suffer a major catastrophe and that doesn’t have to be a virus attack.

I do a weekly image of my partitions and save them to my 2nd hard disk, they can also be saved to off-line storage, DVD, USB external hard disk, etc. as part of my weekly system maintenance.

So if the worst comes to the worst at most I lose:
A. 6 days worth of program updates or new installations, but with my daily back-up I can recover most of that.
B. less than one days data files, emails, etc.
None of these is a problem and much quicker than a system reinstall and I don’t have to go on-line to download the myriad of security updates needed to secure my system where there is a chance to get reinfected whilst my system has vulnerabilities because of these missing patches. Not to mention all my system tweaks and program settings are retained and I will have saved myself many hours of work and a huge amount of stress.

Many of these programs cost, there are some free ones, but it will take some research on your part to find these tools and decide on what is best for you from reviews, user feed back, etc. good luck.

4

Hi DavidR,

In this sense I agree with you that this advice was meant in the first place for people that are very inexperienced security wise, or those that are lacking a good av solution and/or FW.
And also a lot of normal users in a firm are not security trained at all and “eat right out of the hand of the System Admins and believe their every word and order”, and I think this is mainly IT staff threat talk.

I would bet that people that regularly visit our forums and are security aware enough have nothing to fear from fakeware, scumware, bots, adware and what have you. Since I started to help others here with malware cleansing, and since I have acquired the right cocktail of anti-malware programs and tools seen from a few cookies I have been working on a clean OS (as far as I am aware of). But for people without any security awareness and those that click at every message they see, because all that pop ups comes from M$ (they assume), the last resort horizon may be very near, and I think they had these “n00b” users in view, when they wrote this article,

pol

5

Yes, they might well have had inexperienced users in mind when the wrote it.

However, if the user is experienced enough to seek help in the first place to find that article, then hopefully they would find a reasonable support forum like avast. It is seeking help that is the issue also as own their own an inexperienced user wouldn’t contemplate formatting their system, much less how to do it.

6

A reformat is the last resort of the incompetent. This infection can be cleared in two or three posts. Using the following tools

  1. MalwareBytes AntiMalware
  2. A review by using a deep analysis tool to clear any missed files (OTScanit)
  3. Remove tools and reset the restore point.
  4. Wave bye bye

The more difficult to analyse and remove is the Zlob variant that infects the router changing the DNS values. Took twelve posts for me to suss out and cure that one

7

Well that is not necessarily true. for example I bought my computer from my brother. And he had some program discs. More than likely they were downloaded off the net. And So I wiped my hard drives to factory blank. And just installed my windows xp home sp3. Well I went to install the nero disc he gave me and it floaded my hard drive with literally 50 different trojans and worms. Which all came from the antivirus 2008.
Which deleted my control panel, my my computer icons and even in my start menu almost everything was gone. And It would not let me log onto the internet. So yes I had to reformat my hard drive and reinstall windows again. So yeah it is not always the last resort because your incompetent.

8

Hi ennonfenom,

We heard about this, and it is certainly true that a non-detected Antivrus XP 2008 or Antivirus 2009 rogue fakeware infection can be a route to further install of various malware (when it is an install via a bot farm). What is a common factor in these multi-infections is that the victims did not have any active firewall or software firewall installed. Without resident anti-malware or firewall a computer on the Internet does not last long before it is completely ridden with malware. Still there are unaware people that use Windows computers as they come out of the box, and suffer greatly from that experience,

polonus

9

thats true…the first time i bought a computer(6years ago) i was too young and the only thing i wanted is to play pc games…i was aware of viruses etc but never knew that they can me so destructive…my first internet connection was pstn 56kbps and i didnt even know what firewall is and what its job…my AV was norton and i didnt even update it…fortunately my cousin is studying computer science so he teached me some things about internet security etc…now every time i get infected…i can disinfect my pc with closed eyes :stuck_out_tongue:

he also told me some things about norton…so…never used it again :stuck_out_tongue:

10

Hi malware fighters.

If it is a simple Antivirus XP 2008 fakeware infection, this is the manual removal routine reads:

manual removal.

files/folders that should be removed

c:\Program Files\XP Antivirus

c:\Program Files\XP Antivirus\xpa.exe

C:\Program Files\XPAntivirus\

C:\Program Files\XPAntivirus\XPAntivirus.exe

c:\WINDOWS\system32\scui.cpl

%UserProfile%\Desktop\XP Antivirus 2008.lnk

%UserProfile%\Start Menu\XP Antivirus 2008

%UserProfile%\Start Menu\XP Antivirus 2008\Uninstall XP Antivirus 2008.lnk

%UserProfile%\Start Menu\XP Antivirus 2008\XP Antivirus 2008.lnk

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\XP Antivirus 2008.lnk

C:\WINDOWS\krln32.exe

C:\WINDOWS\system32\scvh0st.exe

C:\Program Files\Common Files\trjdwnl.dll

C:\WINDOWS\shlext32.exe

registry removal

HKEY_CURRENT_USER\Software\XP antivirus

HKEY_CURRENT_USER\Software\

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\XPAntivirusFilter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\XPAntivirusFilter

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{4e7bd74f-2b8d-469e-dcf7-f96da086b434}\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{6C6B8C69-9285-4D94-8492-9E920C8C2B65}\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{74f25a2c-22b3-4023-8f1a-ca616c30a8b5}\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{9a19966f-ae0e-4699-8cce-9b6f5f1c352c}\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{D714A94F-123A-45CC-8F03-040BCAF82AD6}\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XP antivirus_is1\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “XP Antivirus”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “mmnext06”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “shellbn”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “System”

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Windows Framework”

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”

But there could also been additional malware (e.g. spam spewing trojan) involved, and as the people behind Antivirus XP 2008 are probably the same as behind the Zlob worm spreaders, makes it nasty malware,

polonus

11
Well I went to install the nero disc he gave me and it floaded my hard drive with literally 50 different trojans and worms. Which all came from the antivirus 2008.
Did you scan it first ?
12

I just came across this and thought it might help:
“If you’re one of the many unlucky PC users to get stuck with this malware beast, you don’t need to reformat your hard drive
(unless you prefer to, of course). At the least, first read Seth Rosenblatt’s instructions for removing Antivirus XP 2008.
He has step-by-step details in plain language for kissing that rogue spyware pest goodbye forever.”
http://www.download.com/8301-2007_4-10041667-12.html?tag=nl.e415

13

I believe that Antivirus XP 2008 and its more nasty Antivirus XP 2009 cousin disables msconfig and Taskmanager.

I think that BleepingComputer’s removal works better as I have used it on my friend’s system:
http://www.bleepingcomputer.com/forums/topic131299.html

14

The hardest item to clean has, for me, been the desktop and screen saver lockouts. Two entries have been added to the group policy in the registry.I usually go into the registry,(KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System) and manually remove the offending entries. Then I am able to reset the desktop and screen-saver.

I have had multiple cases that after running MBAM and SDFix still left the desktop and screen-saver untouchable.