Mates Pc Infected By 'personal Antivirus' , Help !

[ally-b]

My mate asked for PC help , but in this case I'm stumped .

Does anyone know a fix for this ?

It seems to be a fake antivirus site , but is actually a virus itself .

PAV or Personal Antivirus is its name .

His OS is Vista.

Any help appreciated , ta,

Al

[pmacFTO]

I've dealt with this one a few times and it can be easy or bloody hard! The worst version actually survived a HD format numerous times but the majority of infections can be sorted with a few scans and a bit of registry editing.

I do this all the time as a PC Repair man

For a start turn off System Restore (check help on how to do it)! Empty the files inside C:/Windows/Prefetch. Do Windows Update (if you can get to the website as this virus redirects your browser sometimes). Get Spybot, Malwarebytes and HiJackThis - get a good Anti Virus (Avira, NOD32) and boot to safe mode (important!) and run them all and clean whatever they find - run them a few times too. HiJackThis is just a tool to report but the log can tell you a lot - post up the log and I can tell you what to disable after.

If you need to, download all the apps mentioned and stick them on a memory stick and then install them with the PC disconnected from the web.

Before you do all that you could try to do an online scan - you may or may not be able to depending on what the virus has done.

http://www.eset.com/onlinescan/ that's the NOD32 online scanner

http://www.f-secure.com/en_EMEA/security/s...online-scanner/ That is the F-Prot online scanner

(You will need to run these in IE - they don't work in Firefox)

Edited July 30, 2009 by pmacFTO

[mikeb36]

It's a rogue program. I know that MalwareBytes anti-malware removes this parasite. And it could be removed manually, but I think this is very complicated method, because you have to remove those registry entries and other files. You can also use Spyware Doctor to remove Personal antivirus.

[ally-b]

Thanks guys .

I'll try those ideas later today .

Al.