Windows Forum

Ask something
Question Locked

Microsoft Antivirus Malware?

0 helpful
11 replies

by khunter

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I was working on a friend's PC who has what appears to be MAV loaded by accident. It keeps starting an initial scan and telling them to purchase the full package. I found a MAC directory under Program Files and deleted it. I may have to go to the registry and do some cleanup also.

Has anyone dealt with this issue previously? Suggestions?

11 replies

by thumbsup2

So, if you've got something trying to scan that is calling itself Microsoft Antivirus and telling you that you need to purchase the full package, you've got some kind of hostageware/malware/trojan.

Without specific details though, we can't begin to tell you which one you've got. What does it say you need to buy?

by thumbsup2

... I had forgotten about that one and it didn't last very long. But, if the shelf version is what got installed "accidentally", it wouldn't be requiring them to purchase the full package now. If they've downloaded a trial version of a legitimate program and it's expired or requiring them to purchase the full version to do anything with it, all they need to do is uninstall it, not just delete the folder.

Naaaaa.... I'd be willing to bet they've caught "the nasty". ;)

by w2ktechman

program files (uninstalled it), then it should have cleaned itself up a bit. If it is erroring still (trying to load), it was probably added to a startup group somewhere, in which case all you should need to do is uninstall it.

If it is actually not MS Antivirus, then it is likely spyware/malware or a virus (like XP AV08/09). If this is the case, it is probably better to pull out the toolkit and make sure it is removed completely!
You should use Antivirus, Antispyware, and more than 1 of each to scan the systenm (it will take a bit of time).
Good Hunting

by khunter

I'll do some more digging with various utilities and also a manual search of the registry. At least these folks are paying me for my time!

by applejosh

It sounds like a WinAntivirus variant of some variety. Depending on the variant, level of access the user had when the malware was installed (Local Admin, Power User, etc.), it can be difficult to remove. I'd check the registry "Run" keys and also the Winlogon\Notify key for traces of how's it's starting. And I've had some success using Trend Micro's housecall (housecall.trendmicro.com) while running in Safe Mode with Networking.

by kenone

Downloaded "Malwarebytes" and "SDFix"

Ran Malwarebytes - rebooted to "Safe" mode - used the same login (important) - ran SDFix

rebooted

Worked for me, so far so good, may not work for everyone cause there are so many variants out there.

by dumphrey

but needed to run spybot and combo fix as well. I also ran ccleaner a few times after.

I had problems with it preventing malwarebytes installer from running and hijackthis, and combofix as well until each were renamed.

So,
1) Adaware.
2) Malwarebytes
3) Combofix
4) SDfix (run in safe mode, it will reboot to normal to finish)
5) Spybot
6) Ccleaner.

Took some time, but I was also dealing with several other infections.

by rob miners

on its own for a few years now as there always seems to be a couple of others. ;)

Not like the old days when you normally only had one to contend with. ;)

by w2ktechman

that is why my second post mentioned it. Like the XP2008 or 2009 virus ('antivirus' malware package)

This discussion is closed to new replies.