According to the LA Times, victims of the Winfixer, Drive Cleaner and Antivirus XP scam are entitled to a refund.  See here.  http://latimesblogs.latimes.com/money_co/2011/12/scam-watch-computer-virus-warning-ponzi-scheme-fake-bbb-email.html.

If you fall for any other anti-virus scams or have a Rogue Anti-virus or Rogue Anti-Spyware, we can help at our Calgary Virus Removal lab.

Here’s a youtube video from Sophos that shows how you can get infected from a Google Ad advertising Norton.  Note how on the fake Norton website the colors are yellow like Norton Antivirus or Symantec, but there’s no real name, only the word “Anti-virus,” a clue you’re not getting the real deal, but a rogue antivirus. Be aware when going to unfamiliar sites. In the meantime, I’ll try to let Google know this is a fraudulent website. We call that a phish website. Try not to go phishing, the phish ARE biting, but are biting right in the ol kazoo, meaning where it hurts most: your wallet and computer.

If you did buy the fake Norton from the phish website, it wouldn’t work, and would infect your computer with more viruses and spyware.

This is what the HDD Virus (Malware) looks like

The HDD virus advertises itself as a legitimate program, a hard drive defragmenter, but it’s really malware. If you fall for their ploy while trying to defragment your hard drive, you won’t be the first, since we’re seeing many infected computers in the Ducktoes virus lab.

To get rid of HDD virus:

1. Download and run Malwarebytes. Click here to get Malwarebytes. If you have trouble downloading and installing Malwarebytes, start in Safe Mode, by tapping the F8 key while booting. Then pick “Safe Mode with Networking.” Either way, you’ll need to update and run the program. Restart the computer.

2. Next download and run either AVG or Avira. These are both excellent anti-viruses and both free for home use.

3. Then just to be safe, download and run Super-Anti-Spyware.

You should now be HDD Virus Free.

The next blog post will be about good, safe legitimate defragmenters, so stay posted.

If you’re having trouble removing viruses from your computer and you live in Calgary, come to our shop at 902 Centre St. NE right outside downtown or give us a call. We’re Ducktoes Calgary Computer Repair and Virus Removal.

Outside of Calgary, you can use Bleeping Computer to fix your computer for free.

If you need computer repair click here or IT business services click here.

Ms. Ducktoes really feels for the readers whose computers have the Hallmark card virus. So many of you are still coming to this blog for a fix. This has been going on for months.

Since so many of you are still getting infected, today I went on-line to do a more research. I was wondering if there were any new variants etc.

What I found troubled me:

The links lead to a Youtube video which pretends to be a Tutorial but really is an ad for AntispywareOn.com, a rogue anti-virus site that will give you–you guessed it–more spyware and viruses. You can play the video without getting infected but don’t go to AntivirusOn.com. The video’s not much to see; it’s mostly obscured by big letters telling you to go to AntivirusOn.com. Click here to see the video.

Now here’s a video that’s more interesting. The video maker “Video search engine” infects a virtual machine with what you get on AntivirusOn.com and makes a video of the result. And, oh dear, the result looks surprisingly familiar: like another variant of the Windows XP Antivirus 2008/2009!

Ms. Ducktoes wants to stamp her (web) foot, she’s so sick of the Hallmark card virus and the Windows XP Anti-virus!!!

If you have the Hallmark virus, don’t go to AntivirusOn.com and even get more spyware and viruses. I’m sure some of you have already.

If you need to remove the Hallmark Card virus, the Windows Xp Anti-virus 2008/2009 or any other spyware, try this first.

If you already have bad spyware problems and can’t download the anti-spyware abovego here for a fix.

Good luck and as always your comments are most welcome.

If you are one of the millions of people whose computers are infested with the nasty malware Windows Antivirus XP 2008/2009, don’t despair. It’s hard to remove but can be done. I’ve fixed it in four computers now. I tried many different things, but I had the greatest success with SD Fix and Malwarebytes.

Download SD Fix by clicking here. Then you’ll need to reboot into Safe Mode by restarting your computer. As the computer starts up, tap the F8 key several times. If you tap it at the right time, you’ll a screen with several options will appear. One will be Safe Mode. Choose Safe Mode. Next, after a list of drivers is displayed in black and white on your screen, you’ll be asked if you want to go into Safe Mode (Y) or if you want to use System Recovery (N). Pick Y for Safe Mode.

After Windows has started. Go to My Computer and find the C: drive. Double-click it, so it will open. Look for a folder called SD Fix. Inside SD Fix will be a file called RunThis.bat. Click on it. It will run a program to clean up the Trojans. Type Y to begin. SD Fix will delete all the spyware or trojans it comes across. Then you’ll be asked to type any key to restart the computer. Do it, type a key.

Your computer will reboot. As it does, it will finish cleaning up the malware it has found.

Next download Malwarebytes. Update it and run it. It is pretty straight-forward.

You may have to run the above two programs several times to finally get rid of this nasty of all nasties.

If, after removal you find you’re missing your screensaver tab, you can go to my this post to fix it. To see if you’re missing your screensaver tab, go to Control Panel, Display. One of the tabs should be Screensaver.

If you were unfortunate enough to buy this rogue antispyware, you need to call your bank and get a new credit card number. Also you should stop payment on your purchase.

If you want help, and your computer still has the ability go on the Internet. I can fix your computer remotely. Call 403-483-0105 during the day (Mountain Standard Time.)

Ms. Ducktoes now has eat her words, and take back what she said about Grisoft’s free AVG 8 in her last blog. AVG has proved to be a real trooper (a State Trooper even or an RCMP Mountie!) against the criminal and fraudulent Ad Agent BN.

This week the malware has been extremely difficutl to get rid of. Ad Agent BN has been one of the worst.

Ad Agent BN was on a client’s computer, along with several other related Trojans. The client, a friendly twenty-something young man named Matt, had somehow gotten this rogue anti-spyware on his computer. At first the rogue program ran fake warning pop-ups on his desktop saying the computer had spyware. But much worse it then locked up the Matt’s Control Panel, Start menu, and Windows Explorer. Also Run and Search were not accessible.

Matt, a student, needed to turn in his assignments. They were not backed up. The computer was going down fast along with Matt’s marks. I took out the hard drive of his computer and connected it to another computer and ran Spy Sweeper, Avira, and Avast! on the mounted disk. They found several viruses and trojan horses. I also ran regedit by mounting the hive of the harddrive and deleted some infected keys. However when I reconnected the hard drive to Matt’s computer, the spyware and viruses were still there. And they were active!!

Ms. Ducktoes, now in a tizzy about Matt’s marks, not to mention his photos and music, had to do something more. Ducktoes to the rescue!

This is what worked. You can do it too:

1. Boot into Safe Mode with Networking. To do this: Restart the computer. Tap the the F8 key several times while the computer boots up. When you get to the screen with several booting options select Safe Mode with Networking.

2. After Windows starts, then download PC Tools Spyware Doctor, purchase, update it, and run the scan.

3. Restart the computer, let it boot into regular mode several times, restart it after each scan as Spyware Doctor recommends.

4. Boot back into Safe Mode with Networking. Download AVG free. Download AVG 8 free for home users.

5. AVG doesn’t update in Safe Mode. So restart the computer into regular mode. Update AVG. Now run Spyware Doctor. While Spyware Doctor is running the Avg Shields will kick into effect and remove the processes. Using the two programs together will get rid of the Ad Agent BN.

I know that the programs during install tell you that it’s not good to have two anti-viruses running at the same time but it worked!!

So I’m now using free AVG 8 again for all my clients.

Let me know–click the Comments link below– if this works for you.

Now Ms. Ducktoes wants you to be a get all your ducks in a row and make sure your anti-virus software is working, or if you’re too much of a newbie to understand or know what you’re doing yet, get a friend or co-worker to help you. And to train you. Or hire a techie to check it and train. Ignorance is not bliss when it comes to computers.

1. Make sure your anti-virus is downloading updates regularly and running scans automatically and that if it is a paid subscription, that you have paid on time. Don’t be without working anti-virus software for one nano-second. It is like tossing your computer out a second story window. The result’s not pretty. If you are fond of your computer or what is on it, take charge.

Also a reader of this blog who really knows his stuff has recommended Avira for an excellent anti-virus software. Here’s the link. I used it on a client’s computer and it worked well. It found and removed viruses and didn’t use up all the computer’s resources. That’s called having a small footprint. And it’s free for personal, home use. Don’t put it off. Here’s a link to his comments (you’ll have to scroll down).

2. Also use a different browser besides Internet Explorer. Use Firefox or Opera.

3. And after you have done all that, get anti-spyware too. Click here to see how to do that.

Anti-virus, anti-spyware, Firefox or Opera, and you’ve protected your computer, your wallet, your identity.

For more information click here.

For you techies among my readers, always make sure the client has working and up-to-date anti-virus and anti-spyware. Do this check as part of your routine. Tell them where they are amiss and install both if necessary. I recommend both manual anti-spyware such as Spybot and Ad-aware SE and one that runs in real time. Read the next post on this blog for more hints for techies.

As always Ducktoes to the rescue!! If you live in the Calgary area give us a shout or even if you don’t.

Ta ta for now.

Today I’m removing (from an Acer laptop) a trojan called Win32.Renos. It causes false alerts on the desktop purporting to be from Windows. If you click on the alert, the trojan then downloads a rogue anti-spyware called Win SpyControl, AntiSpy Kit, and Virus Ranger.

The alert looks like this or some other warning:

This is a photo of the alert that Win32 Renos causes to pop-up on your desktop.

The rogue anti-spyware seems to be associated with the Zlob download trojan too and a web address http://www.safestarts.com/test/?c=440785. (Warning, don’t go to that site!!)

I removed it using Spy bot and Spyware Doctor.

Here’s what Microsoft says about this spyware. Microsoft associates Win32.renos with SpySheriff group of rogue anti-spyware products.

Whichever rogue anti-spyware Win32.renos is linked to, they all do the same thing. They attempt to get you to download and pay for bogus anti-spyware that is really spyware itself. This is fraud. It also infests your computer with lots of dangerous spyware.

Ducktoes to the rescue!! Please leave a comment if you have more to add about this problem or any questions.

This is a photo of the alert that Win32 Renos causes to pop-up on your desktop.

I’m excited!! I’ve been reading the article on Spyware in Wikipedia. It’s excellent. If you want in depth knowledge about what malware is and does, read it.

The photo on the page shows a browser overloaded with toolbars. If you have unwanted toolbars on your browser window then that is one indication you have spyware. See here how to get rid of it.
Or if you live in Calgary, Ducktoes can help.

A new rogue anti-spyware has just crested over the cyber-horizon. By rogue anti-spyware, I mean a program that is supposed to get rid of spyware, but is actually spyware and malware itself. SunshineSpy is this decidedly unsunshiny program.

SunshineSpy gives you fake infection warnings and dire security alerts and uses rootkits to hide its dastardly and fraudulent doings from legitimate anti-spyware programs. It preys on the newbie and untrained computer user.

It is surprisingly easy to get rid of, however. Just go to your green start button on the bottom left of your computer screen. From there go to Control Panel and then to: Add and Remove Programs. From the list of programs that will eventually appear find SunshineSpy, and click the button to remove it. Restart your computer.

All anti-spyware is not equal. Many do not remove spyware reliably. Some show false positives and push their products in a high pressure way. A few actually come bundled with spyware or malware. The Spyware Warrior Website has a list of rogue, suspect anti-spyware and websites. Check it out before you purchase and download any anti-spyware.

There are some excellent anti-spyware programs that are free for home users. See other postings in this blog. If you want help, Ducktoes will provide the anti-spyware for your computer(s). We make on-site visits to Calgary area homes and businesses. Call (403)287-0105 or e-mail me.