Fake AV Virus FAV Removal Cleaning and Repair
The issue is you have a FAV problem and you want to remove it. Use each of the following free antivirus download programs one at a time, some infections may require Rootkit Tools to ensure just about any Malware infection is removed.
Combo-fix FREE - bleepingcomputer.com/download/anti-virus/Combofix
This is a great Free Fake AV removal tool, but you must read and follow all of the instructions or your computer may become inoperable. Your existing AV program must be disabled before use.
HitmanPro 30 Day Trial - surfright.nl/en/hitmanpro
This is a fast, good, a second opinion antivirus, Hitman Pro can run even if your existing antivirus program is running / Active. Ensure you download the appropriate version 32 bit or 64 bit.
GMER - FREE - gmer.net
Yet another great Free antivirus Program. ENSURE you read and follow their instructions. It's nice to see there are a lot of nerds wearing white hats.
Kaspersky FAV program - support.kaspersky.com/viruses/solutions?qid=208280684
Disinfects an infected computer of some Fake Antivirus variants. Download the TDSSKiller.exe and run the application. This program can run while your AV is active. Kaspersky's RK remover is fast but looks primarily for TDSS, Aleron, and Tidserv type RK variants.
The goal of this web page is to present the steps you should follow to remove Malware infections using these FAV Tools. Ensure you have at least two good complete system backups before proceeding. Use another computer to create a bootable UBCD4WIN CD or a bootable USB flash drive, boot from the UBCD4WIN on the infected PC and use the backup utilities copying your data to external USB hard drives. Label the backups as infected so as to not spread the infection to other computers. Also, purchase a USB flash drive with hardware write protection, so downloaded FAV removal tools can be copied to the infected computer without the USB flash drive getting infected. Ideally, you should follow the steps in sequence, but some infections may prevent using several cleaning programs. If you cannot use one of the cleaning utilities, go to the next step and see if it removes the infection(s). Try using EVERY cleaning program to ensure the infection(s) has been removed. Malware infections are designed by Cyber-Criminals to steal your personal information and these unauthorized programs are very sophisticated and difficult to remove. It may take many hours or several days to scan, clean and repair your Malware infection (s). Please be patient, follow the steps, read the instructions and keep your "fingers crossed". Sometimes the only way to repair your computer is just never give up.
Cyber criminals use these sorts of viral infections to fool end users with Social Engineering. That is to say, criminals hire very talented programmers to create a virus that mimics the look and feel of a real AV program or that pops up information balloons on the tray near the clock, which look EXACTLY like Microsoft popups. The Cyber Criminal wants your Credit Card information and your entire identity to resell on their nefarious web sites to other criminals. Microsoft NEVER asks for your credit card information via a popup balloon or via email. And most legitimate AV programs should never be updated based on a popup. Just as in the physical world, end users should never give any information to strangers. It was reported that one arrested Korean Woman was making over 15 million US dollars per year with this FAV malware. Russian Criminal Gangs also are reputed to use these scams to fool end-users into giving up their credit card information to buy these sorts of malicious programs. Recently it has been reported that 2 / 100 web sites are infected and pass on the infection to endusers as they surf legitimate web sites. Never answer any question to a popup, rather ask your IT friend or contact your boss before clicking Yes or No if you receive one of these FAV balloon popups. With each answer or re-starting of your computer the FAV malware hooks deeper into your computer. A best practice would be to unplug your Ethernet internet cable if you suspect you have an infection and then call qualified support before doing anything else.
