The Geeky Asian Guy Blog

Yesterday, I Googled my own blog and found a link to an unfamiliar site.  I clinked on the link and…

All of a sudden, my computer starts downloading a *pile* of random crap.  I click the “cancel” button, but the stuff keeps pouring onto my hard drive.

Moments later, a popup window announces that my computer is infected, and provides a link to a website to purchase something called “Antivirus XP 2008.”  The window starts popping up every couple of minutes.

Here’s the really scary part — all the crap loaded onto my computer manages to do the following:

1. It changed my Desktop to a hideous bright blue with a yellow rectangle in the middle telling me that my computer is infected.
2. It changed my Internet Explorer home page to their page.
3. It added links to my Quick Start menu and Desktop.
4. It disabled Task Manager — so I can’t stop the stupid thing from running.
5. It disabled Registry Edit — so I can’t open the registry to try to fix the problem.
6. It removed the “Run” button from the Start Menu, so I can’t run any DOS commands.
7. It removed the “Control Panel” button from the Start Menu, so I can’t change my PC’s settings.
8. It removed the “Search” button from the Start Menu, so I can’t look for their files to delete them.
9. It changed the “My Computer” directory to hide the C: drive, so I can’t find their files and delete them.
10. It wiped out all earlier System Restore points so that System Restore is now useless.

There were probably other things that I didn’t even notice.

The first rule when this kind of thing happens is:  DON’T PANIC.  Don’t start deleting stuff.  Don’t try to edit your registry.  If you have HijackThis, you can print out a report, but don’t start zapping random-looking files.  It is surprisingly easy to brick your computer once you start messing with system files.

Leave the infected computer alone.  Go to another computer and start Googling.  (What?  You *still* only have one computer?  Seriously, dude, go to www.dfsdirectsales.com, eBay, or wherever, and buy a cheap second computer.  It is so worth it.)

My Googling efforts uncovered the following:

1. Antivirus XP 2008 is the latest in a long line of malware that is designed to extort money from PC users desperate to get rid of all of the annoying pop-ups.
2. AVXP comes from the former Soviet Union — be *very* careful if you ever see any URL that ends in .su.
3. Although it is unbelievably obnoxious, AVXP doesn’t seem to harm any of the data or software on your computer.
4. I gather that if you pay their blood money, the software they sell you will solve the problem (but will undoubtedly put you on some sort of “sucker” list on which you will remain for the rest of time).
5. My understanding is that AVXP only detects and removes fake security threats that AVXP itself placed onto your computer during the initial attack.  Therefore, as I understand it, there is no reason to get the software, other than to get rid of the problem that they themselves created.
6. Other commercial anti-malware products may also work.  I suspect, but have no proof, that some of those commercial products (which usually go for something like $29.95 per license) are in cahoots with AVXP.
7. However, you can get rid of AVXP for free (really, for free) – www.malwarebytes.org has a free anti-malware program that, much to my intense astonishment, joy, and gratitude, solved the problem completely.
8. Also free: SUPERAntispyware (www.superantispyware.com).  One site recommended running the free version of this product in Safe Mode after you get rid of AVXP.  (To enter Safe Mode, reboot your PC while pressing F8.)
9. And: BitDefender (http://www.bitdefender.com/scan8/ie.html).  They have a 100% free scan you can run at the end to make sure you’ve gotten rid of any last remnants of AVXP.
10. I urge you to use Google (or whatever search engine you prefer) to double-check and confirm everything in this post before trying to apply any of it.

Good luck!