PDA

View Full Version : Desktop Antivirus 2010 Is The [Expletive Deleted] Of An [Expletive Deleted]


Seil
09-02-2010, 10:11 PM
So a while back, I was talking about my computer. It's a frankenstein monstrosity, pieced together through the years, surviving being a family computer and eventually ended up as mine. It's an old hunk of junk that has half-deleted files, bits and pieces of spyware and never really runs very well. Since it does actually run, though, and I can't afford a new one, I'm stuck with it.

Now, it got infected with Desktop Antivirus 2010. (http://www.xp-vista.com/remove/antivirus-2010) That link there is to one of many online guides that the web offers - though much of the guides suggest the same thing. The virus itself is installed via Trojan (apparently) and sets up shop. After a few days, it makes its presence known by:

a) Initiating false blue screens (http://www.thestubware.com/malware_removal/antivirus2010/antivirus2010.gif)
b) Pop-ups on your desktop initiating false virus scans
c) Messages stating that your computer is infected and to pay for the service to fix things

Trying to delete the thing is amazingly difficult. It pops up on the "Add/Remove Programs" list, but requires a registration key to uninstall it. Malwarebites AntiMalware didn't do me any good. I tried to unregister the .DLL files, and a Windows prompt told me I couldn't. I tried multiple virus scanning things - the only things that told me I even had a virus were Spyware Doctor and ExterminateIt, but as I had just downloaded the trial versions, they wouldn't delete it. Nearly any antivirus program that I start ends in one of the false blue screen.

But they did list the file extensions. So I went down the list and started deleting stuff, and ended up getting rid of the wrong thing, because the next time I booted the computer, it gave me the prompt that I had three days to re-register Windows. I was at the end of my rope, so after about a month, I took it to a shop in town. The person there promptly did a few virus scans, determined nothing was wrong, billed us $90 for his time, and gave the computer back. The virus is still there.

Now, as I said in the first post, it's not a top-of-the-line machine. I know that, and I'm hopefully getting a laptop soon. It's just that while I have it now, I'd like to be able to use it. Does anyone have any suggestions that would keep me from taking a sledgehammer to it?

Because at this point, I really want to take a sledgehammer to it.

Marc v4.0
09-02-2010, 11:26 PM
Restart in safe mode and try those "Delete/Stop these things" steps in the link you provided.

Eldezar
09-03-2010, 12:34 AM
get your money back

edit: in regards to the virus, when i had the 2008/2009 version, i spent three days getting rid of it. I would first unplug my network cable, so no internet access which is how a lot of those viruses keep coming back. Run a full scan of my anti-virus (AVG free for me) which would delete a few things but rarely deleted everything. It did however show a list of the registry files that the virus added, so I manually deleted those. I would then reconnect to the internet, update my anti-virus, then immediately unplug the network cable again. Repeat previous steps.

Never had the new one and the old ones never gave false blue screens, but you may consider similar steps.

Seil
09-03-2010, 01:14 AM
Restart in safe mode and try those "Delete/Stop these things" steps in the link you provided.

Because last time it worked oh so well, what with the computer yelling at me.

edit: in regards to the virus, when i had the 2008/2009 version, i spent three days getting rid of it. I would first unplug my network cable, so no internet access which is how a lot of those viruses keep coming back. Run a full scan of my anti-virus (AVG free for me) which would delete a few things but rarely deleted everything. It did however show a list of the registry files that the virus added, so I manually deleted those. I would then reconnect to the internet, update my anti-virus, then immediately unplug the network cable again. Repeat previous steps.

It's on the computer - and I've tried AVG a few times. It didn't stop it. Any atempt I make now via a legit antivirus thing comes up with a blue screen of fake.

Toast
09-03-2010, 05:54 AM
When I had antivirus 2008 a while back, I had to use rootrepeal (http://sites.google.com/site/rootrepeal/) first before avg would fix it in safe mode.

Unfortunately, I can't seem to find the instructions for how I did it.

EVILNess
09-03-2010, 11:47 AM
does your computer have a restore partition or do you own a windows install cd? If so then just grab the important stuff and reinstall windows, because that is the only way I have been able to reliably fix that kind of infection.

Besides it seems like you need a fresh install anyway.

Torque
09-04-2010, 10:25 AM
When I had it, for some reason it was quite simple for me... I ran malware bytes in normal, and safemode, and huzzuh, gone for good. sorry to hear it's so sucky for you.
I got this from 2-spyware.com though, maybe they might give you a helping hand as you seem to be rather savvy when it comes to tinkering with a computers internal workings:

Home Antivirus 2010 manual removal:
Kill processes:
HomeAntivirus2010.exe Uninstall.exe rufa.exe atowu.exe
HELP:
how to kill malicious processes

Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREHomeAntivirus2010
HKEY_LOCAL_MACHINESOFTWAREMicrosoftESENTProcessIns tall
HKEY_LOCAL_MACHINESOFTWAREMicrosoftESENTProcessIns tallDEBUG
HKEY_CURRENT_USERControl Paneldon't load "scui.cpl"
HKEY_CURRENT_USERControl Paneldon't load "wscui.cpl"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionRun "Home Antivirus 2010"
HELP:
how to remove registry entries

Unregister DLLs:
AVEngn.dll htmlayout.dll pthreadVC2.dll msvcm80.dll msvcp80.dll msvcr80.dll ciqudehyri.dll vivifabyx.dll akywiweni.dll
HELP:
how to unregister malicious DLLs

Delete files:
AVEngn.dll HomeAntivirus2010.cfg HomeAntivirus2010.exe htmlayout.dll pthreadVC2.dll Uninstall.exe wscui.cpl daily.cvd Microsoft.VC80.CRT Microsoft.VC80.CRT.manifest msvcm80.dll msvcp80.dll msvcr80.dll HomeAntivirus2010.lnk Uninstall.lnk dicy.sys oxysa.dl vimufil.dat _scui.cpl boxica.reg jimysa.sys ylekoxipe.bin ovysenuv.ban ecanynedy.pif iwexuhor.inf omupaw.scr xonocyd.sys rufa.exe xatem.vbs akywiweni.dll atowu.exe ufig.reg upagyxej.lib uwud.ban akufan.db puqobu.bat robomero.vbs xojusiban.dat otakyhegem.sys rohysewys.lib
HELP:
how to remove harmful files

Delete directories:
C:Program FilesHomeAntivirus2010
c:Program FilesHomeAntivirus2010data
%UserProfile%Start MenuProgramsHomeAntivirus2010

edit: not sure if it'll help, but I LOVE bleepingcomputer.com
http://www.bleepingcomputer.com/virus-removal/remove-antivirus-2010

Nikose Tyris
09-04-2010, 10:48 AM
Ran spybot in safemode, told it to run after a restart with cleared memory. fixed the problem. Just did it today to a friend's PC.

Professor Smarmiarty
09-04-2010, 10:58 AM
Ive seen that one before and got rid of it was MalwareBytes. Dont know why it didn't work for you. Try fiddle with the settings?

Seil
09-04-2010, 03:39 PM
What's a Spybot?

Azisien
09-04-2010, 03:59 PM
I've seen some where MalwareBytes didn't work, but in those cases, rootkit scan with Avast did (or any other AV with a rootkit scan).

Hanuman
09-04-2010, 04:00 PM
Spybot is a protection program. Seil format your damn hard drive.

Torque
09-05-2010, 12:17 AM
Seil format your damn hard drive.

Yeah, I agree.... Nothing like a good fresh start every one in awhile