As per our previous conversation I wanted to mention why virus remediation online is so difficult. It's very difficult to know whether or not removing the virus will cause adverse effects on your computer, whether or not there are hidden viruses on your computer, and the possibility of assessing the wrong virus.
First of all, Antivirus Live is not a legitimate antivirus program as mentioned by Chuey. A description of Antivirus Live holds as follows:
Do not download Spyware Hunter. It is also a program notorious for giving false positives. As everyone mentioned you should try downloading Malware bytes on your Mac and loading it on a USB drive. You can download Malware bytes from this site: http://download.cnet.com/Malwarebytes-An...tag=button
Once you download it, transfer it to your USB and then bring it over to your infected laptop. Once you reach your infected laptop, boot in safe mode with no networking using f8 or delete key on startup. Drag over malwarebytes to your desktop and double click on the icon to execute the program. This will hopefully get rid of Antivirus Live.
Condition: Malwarebytes does not execute after numerous attempts.
This is not a problem with Malwarebytes. The virus is blocking Malwarebytes from being executed. Some viruses block programs by targeting the name of the executable file and can be bypassed by changing the name of the .exe file.
Warning! Imagine dumping.
Condition: Still does not load bro.
Okay. Go to start and select on run. Type in "regedit"
We're going to clean out your registry
! Just to make sure you should see the following prompts listed on the screen.
We're going to go and target Antivirus Live first because we KNOW this is an issue. When running a very basic google search the following websites indicate that Antivirus Live changes/adds the following files in your registry:
Source: http://www.spywareremove.com/removeAntivirusLive.html & http://www.spywarevoid.com/remove-antivi...al_removal
Registry:
HKEY_CURRENT_USER\Software\AvScan
HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
and/or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Live"
You can go about deleting such files by searching the parent directory. Example, click on HKEY_CURRENT_USER > SOFTWARE > AvScan: right click and then select delete on malicious entry. Again this runs a risk of possibly deleting important registry files. Be cautious. If you catch anything else while sifting through your registry such as: SOFTWARE> boysgonewild.com then of course delete this as well. It's obviously a redirect and attached to the original virus infection.
Wait. Before we proceed. Let's disable System Restore. Conduct a search for System Restore:
Wait! System Restore is supposed to help me!!!! Most viruses have the potential to infect a System Restore calendar and re-download viruses on "restore points" thereby bringing the malicious software back every month or so, I know this because my sister happened to get my computer into a similar situation. There are numerous better solutions than using system restore. One method which my friend uses is to save the image to a CD where he can reinstall the OS along with the files by booting the CD.
Let's proceed! Reboot your computer and load up in safe mode one more time.
Try running Malwarebytes again!
Condition: Still does not load bro.
Okay. There are several things we can do but more or less I've give you the basic concept of how to remove viruses.
1. Use various automated antivirus programs. Personally some antivirus programs conflict with one another. One combination I prefer using is a Spybot which is a definitions based anti-virus tool along with Adaware which is a heuristic antivirus tool. AVG and a bevy of other antivirus tools are grand as well. Do now download a fake one. Please.
2. Hijack this log. Download and execute hijack this and get a log. Repost it here, there, everywhere. Get advice from everyone. Someone out there has had to have had the same virus and was helped by some kind soul in the past. Try some other scans like Belarc and so forth. Again, keep away from fake ones.
3. It's vundo or some other root-kit program. Sweet! No, this really sucks. I would suggest trying a program called Avenger: http://swandog46.geekstogo.com/avenger2/avenger2.html
This program is extremely powerful at targeting rootkits but at the same time because a rootkit heavily rewrites your OS it can also cause major problems for your computer at the same time. I would use swandog in conjunction with feedback from your hijack this log on a professional page like Microsoft or getting feedback from someone computer savvy.
4. This is the most important! Always cross-reference with google/wikipedia. Downloading anything deserves a google search with an added search of (+ virus or + removal). Also when you are going about sifting through your registry, cross-referencing suspicious keys can lead you to identify other viruses possibly infecting your computer.
That's pretty much all the advice I can give. Again it's hard not knowing what you exactly have but you should try all of the above advice and try getting back to us. Good luck with your virus remediation issue.
Note: I don't believe you should re-enable your system restore simply because of personal issues with it in the past. It's up to your discretion whether or not you want to trust it to help you problem but I don't trust it at all as a sure-fire virus solution.
First of all, Antivirus Live is not a legitimate antivirus program as mentioned by Chuey. A description of Antivirus Live holds as follows:
SpywareRemove Wrote:Antivirus Live (also known as AntivirusLive) is the latest Rogue Anti-Spyware creation from the notorious Magic Software stable. Antivirus Live uses malicious cutting-edge techniques, including the use of backdoor Trojans. Once active, Antivirus Live disables the computer's security options, making it extremely difficult to uninstall through the Control Panel or via Safe Mode. Antivirus Live then starts spewing annoying popup ads and runs a security scan which reports the fake detection of numerous viruses and threats. Antivirus Live will recommend buying its licensed copy to solve the alleged spyware problems. Do not fall for Antivirus Live's trickery. This hazardous parasite should be terminated from the system immediately.
Do not download Spyware Hunter. It is also a program notorious for giving false positives. As everyone mentioned you should try downloading Malware bytes on your Mac and loading it on a USB drive. You can download Malware bytes from this site: http://download.cnet.com/Malwarebytes-An...tag=button
Once you download it, transfer it to your USB and then bring it over to your infected laptop. Once you reach your infected laptop, boot in safe mode with no networking using f8 or delete key on startup. Drag over malwarebytes to your desktop and double click on the icon to execute the program. This will hopefully get rid of Antivirus Live.
Condition: Malwarebytes does not execute after numerous attempts.
This is not a problem with Malwarebytes. The virus is blocking Malwarebytes from being executed. Some viruses block programs by targeting the name of the executable file and can be bypassed by changing the name of the .exe file.
Warning! Imagine dumping.
Spoiler
![[Image: picture1.jpg]](http://i133.photobucket.com/albums/q45/Passwordv2/picture1.jpg)
![[Image: picture2.jpg]](http://i133.photobucket.com/albums/q45/Passwordv2/picture2.jpg)
![[Image: picture3.jpg]](http://i133.photobucket.com/albums/q45/Passwordv2/picture3.jpg)
![[Image: picture4.jpg]](http://i133.photobucket.com/albums/q45/Passwordv2/picture4.jpg)
Condition: Still does not load bro.
Okay. Go to start and select on run. Type in "regedit"
We're going to clean out your registry
! Just to make sure you should see the following prompts listed on the screen.
Spoiler
![[Image: registryeditor.jpg]](http://i133.photobucket.com/albums/q45/Passwordv2/registryeditor.jpg)
We're going to go and target Antivirus Live first because we KNOW this is an issue. When running a very basic google search the following websites indicate that Antivirus Live changes/adds the following files in your registry:
Source: http://www.spywareremove.com/removeAntivirusLive.html & http://www.spywarevoid.com/remove-antivi...al_removal
Registry:
HKEY_CURRENT_USER\Software\AvScan
HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
and/or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Live"
You can go about deleting such files by searching the parent directory. Example, click on HKEY_CURRENT_USER > SOFTWARE > AvScan: right click and then select delete on malicious entry. Again this runs a risk of possibly deleting important registry files. Be cautious. If you catch anything else while sifting through your registry such as: SOFTWARE> boysgonewild.com then of course delete this as well. It's obviously a redirect and attached to the original virus infection.
Wait. Before we proceed. Let's disable System Restore. Conduct a search for System Restore:
Spoiler
Wait! System Restore is supposed to help me!!!! Most viruses have the potential to infect a System Restore calendar and re-download viruses on "restore points" thereby bringing the malicious software back every month or so, I know this because my sister happened to get my computer into a similar situation. There are numerous better solutions than using system restore. One method which my friend uses is to save the image to a CD where he can reinstall the OS along with the files by booting the CD.
Let's proceed! Reboot your computer and load up in safe mode one more time.
Try running Malwarebytes again!
Condition: Still does not load bro.
Okay. There are several things we can do but more or less I've give you the basic concept of how to remove viruses.
1. Use various automated antivirus programs. Personally some antivirus programs conflict with one another. One combination I prefer using is a Spybot which is a definitions based anti-virus tool along with Adaware which is a heuristic antivirus tool. AVG and a bevy of other antivirus tools are grand as well. Do now download a fake one. Please.
2. Hijack this log. Download and execute hijack this and get a log. Repost it here, there, everywhere. Get advice from everyone. Someone out there has had to have had the same virus and was helped by some kind soul in the past. Try some other scans like Belarc and so forth. Again, keep away from fake ones.
3. It's vundo or some other root-kit program. Sweet! No, this really sucks. I would suggest trying a program called Avenger: http://swandog46.geekstogo.com/avenger2/avenger2.html
This program is extremely powerful at targeting rootkits but at the same time because a rootkit heavily rewrites your OS it can also cause major problems for your computer at the same time. I would use swandog in conjunction with feedback from your hijack this log on a professional page like Microsoft or getting feedback from someone computer savvy.
4. This is the most important! Always cross-reference with google/wikipedia. Downloading anything deserves a google search with an added search of (+ virus or + removal). Also when you are going about sifting through your registry, cross-referencing suspicious keys can lead you to identify other viruses possibly infecting your computer.
That's pretty much all the advice I can give. Again it's hard not knowing what you exactly have but you should try all of the above advice and try getting back to us. Good luck with your virus remediation issue.
Note: I don't believe you should re-enable your system restore simply because of personal issues with it in the past. It's up to your discretion whether or not you want to trust it to help you problem but I don't trust it at all as a sure-fire virus solution.