ContraVirus

Viruses and worms
1

Multiple friends and co-workers have reported problems with a new malware scam called ContraVirus. ContraVirus APPEARS to be a legitmate spyware/malware removal tool, but the use of their ‘free scan’ prompts the user to install ContraVirus’ free software. Upon installing this software, your computer is attacked by a series of notifications informing you that your computer is infected with malware (malware INSTALLED by ContraVirus) and that you must purchase their software to removal said malware.

In two instances, users I know were running Norton 2005 (not exactly computer savvy folk, so they go with whatever BestBuy or insert computer chain here tells them is best. Updating Norton 2005 all the way won’t remove ContraVirus. One of these users broke down and purchased Norton 2007 (a resource hogging plague imo), which successfully removed the software. I would like to promote the use of avast! by more people (I’m the only person I know locally that uses it and I’m convinced it’s one of the top anti-virus applications out there, and by far the best FREE application). I will only have avast! installed on their computer if it CAN remove ContraVirus.

I searched the forums and couldn’t find anything. Any information would be appreciated.

2

This isn’t new, this kind of scumware (scam) has been going for some considerable time, only the name changes. Never download anything that alerts you to an infection on your system when ‘you’ didn’t install the application doing the detection, common sense will go a long way here and then investige the alerts, google, forums, etc.

The problem is that the actual program isn’t infected (a virus), just pops up windows, etc. and encourages you to scan (download) your system. Which is why you are seeing that many AVs don’t detect this directly, it may well detect what it tries to download.

There is a tool RogueRemover, available here http://www.malwarebytes.org/rogueremover.php removes much of this Rogue Anti-Spyware scam/scum.

3

After using RogueRemover, I suggest a full scan with other antitrojan applications.
If a virus is replicant (coming and coming again), you should:
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.