Antivirus 2009

I was doing a Yahoo search for a Peter, Paul and Mary song "Cruel War" when I
was interupted with a message that appeared to come from Windows Internet
Explorer. I noted a spelling error and took a screenshot of it to save it for
a later enquiry with Microsoft. I clicked cancel and it did a brief,
unprompted scan and displayed a "scan result" list with inoperable option
buttons and an offer to download Antivirus 2009. I assumed I had to purchase
such programs but it said it was free. I became suspicious but hit SAVE
instead of RUN. It boxed me in and the X (Close) button only returned me to
the RUN or SAVE window. It froze IE so I couldn't reach my Task Manager. I
consulted with my son and he recognized the name "Antivirus 2009" as "rogue
software" or "malware". He hit ALT+F4 and released IE.

I now have Antivirus 2009 downloaded but not yet installed.

I now have a screenshot of the original "Windows Internet Explorer" message
that encludes a spelling error, peculiar syntax and the word "behaviour"
which makes me suspect it originates in Great Britain or Europe.

I thought there was a place to report such things to Microsoft, but where?

I understand there are several programs available that will remove Antivirus
2009 but I also understand there are legitimate programs going by that name.
This one uses the same Security Shield as Windows Firewall.

I'm going to keep my downloaded Antivirus 2009 as both a souvenir and as
evidence.

One would think Microsoft would have a Crimestoppers Section - a place
easily reached to report such activity and get a clear cut explanation of the
issue.

Follow the music.


----------------
This post is a suggestion for Microsoft, and Microsoft responds to the
suggestions with the most votes. To vote for this suggestion, click the "I
Agree" button in the message pane. If you do not see the button, follow this
link to open the suggestion in the Microsoft Web-based Newsreader and then
click "I Agree" in the message pane.

http://www.microsoft.com/communities...orer. general

I suggest that the machine is already infected.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjunction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


Twentiethman wrote:
> I was doing a Yahoo search for a Peter, Paul and Mary song "Cruel War"
> when
> I was interupted with a message that appeared to come from Windows
> Internet
> Explorer. I noted a spelling error and took a screenshot of it to save it
> for a later enquiry with Microsoft. I clicked cancel and it did a brief,
> unprompted scan and displayed a "scan result" list with inoperable option
> buttons and an offer to download Antivirus 2009. I assumed I had to
> purchase
> such programs but it said it was free. I became suspicious but hit SAVE
> instead of RUN. It boxed me in and the X (Close) button only returned me
> to
> the RUN or SAVE window. It froze IE so I couldn't reach my Task Manager. I
> consulted with my son and he recognized the name "Antivirus 2009" as
> "rogue
> software" or "malware". He hit ALT+F4 and released IE.
>
> I now have Antivirus 2009 downloaded but not yet installed.
>
> I now have a screenshot of the original "Windows Internet Explorer"
> message
> that encludes a spelling error, peculiar syntax and the word "behaviour"
> which makes me suspect it originates in Great Britain or Europe.
>
> I thought there was a place to report such things to Microsoft, but where?
>
> I understand there are several programs available that will remove
> Antivirus
> 2009 but I also understand there are legitimate programs going by that
> name.
> This one uses the same Security Shield as Windows Firewall.
>
> I'm going to keep my downloaded Antivirus 2009 as both a souvenir and as
> evidence.
>
> One would think Microsoft would have a Crimestoppers Section - a place
> easily reached to report such activity and get a clear cut explanation of
> the issue.
>
> Follow the music.
>
>
> ----------------
> This post is a suggestion for Microsoft, and Microsoft responds to the
> suggestions with the most votes. To vote for this suggestion, click the "I
> Agree" button in the message pane. If you do not see the button, follow
> this
> link to open the suggestion in the Microsoft Web-based Newsreader and then
> click "I Agree" in the message pane.
>
> http://www.microsoft.com/communities...orer. general

It's a well-known virus. The pain-in-the-ass effect you noticed is caused by
JavaScript.

I got caught in this once on someone else's computer and it would not let me
out of it's clutches. No matter what button you press, it brings up that
screen.

At some point, I allowed the download dialog to show itself. This freed up
IE from popup windows so on Internet Explorer I could access Tools >
Internet Options > Security. From Custom Level, I disabled all JavaScript
and VBscript.

At this point you can disallow the download and the JavaScript popups will
stop. Make a note of the domain name and add it to IE's "Restricted sites"
(which you should have set so that script and everything else is disabled).
Close your browser window, then re-enable scripts again.

To prevent this from happening again, install Spybot Search and Destroy on
your computer. The "immunize" function places websites like those in your
Restricted Zone. As of today, there are 188,868 sites that Spybot will
protect you from.
http://www.safer-networking.org/



"Twentiethman" wrote...
>I was doing a Yahoo search for a Peter, Paul and Mary song "Cruel War" when
>I
> was interupted with a message that appeared to come from Windows Internet
> Explorer. I noted a spelling error and took a screenshot of it to save it
> for
> a later enquiry with Microsoft. I clicked cancel and it did a brief,
> unprompted scan and displayed a "scan result" list with inoperable option
> buttons and an offer to download Antivirus 2009. I assumed I had to
> purchase
> such programs but it said it was free. I became suspicious but hit SAVE
> instead of RUN. It boxed me in and the X (Close) button only returned me
> to
> the RUN or SAVE window. It froze IE so I couldn't reach my Task Manager. I
> consulted with my son and he recognized the name "Antivirus 2009" as
> "rogue
> software" or "malware". He hit ALT+F4 and released IE.
>
> I now have Antivirus 2009 downloaded but not yet installed.
>
> I now have a screenshot of the original "Windows Internet Explorer"
> message
> that encludes a spelling error, peculiar syntax and the word "behaviour"
> which makes me suspect it originates in Great Britain or Europe.
>
> I thought there was a place to report such things to Microsoft, but where?
>
> I understand there are several programs available that will remove
> Antivirus
> 2009 but I also understand there are legitimate programs going by that
> name.
> This one uses the same Security Shield as Windows Firewall.
>
> I'm going to keep my downloaded Antivirus 2009 as both a souvenir and as
> evidence.
>
> One would think Microsoft would have a Crimestoppers Section - a place
> easily reached to report such activity and get a clear cut explanation of
> the
> issue.
>
> Follow the music.
>
>
> ----------------
> This post is a suggestion for Microsoft, and Microsoft responds to the
> suggestions with the most votes. To vote for this suggestion, click the "I
> Agree" button in the message pane. If you do not see the button, follow
> this
> link to open the suggestion in the Microsoft Web-based Newsreader and then
> click "I Agree" in the message pane.
>
> http://www.microsoft.com/communities...orer. general

You can try using a program such as malwarebytes to remove it. It worked well
for the 2008 version.

"Victor" wrote:

> It's a well-known virus. The pain-in-the-ass effect you noticed is caused by
> JavaScript.
>
> I got caught in this once on someone else's computer and it would not let me
> out of it's clutches. No matter what button you press, it brings up that
> screen.
>
> At some point, I allowed the download dialog to show itself. This freed up
> IE from popup windows so on Internet Explorer I could access Tools >
> Internet Options > Security. From Custom Level, I disabled all JavaScript
> and VBscript.
>
> At this point you can disallow the download and the JavaScript popups will
> stop. Make a note of the domain name and add it to IE's "Restricted sites"
> (which you should have set so that script and everything else is disabled).
> Close your browser window, then re-enable scripts again.
>
> To prevent this from happening again, install Spybot Search and Destroy on
> your computer. The "immunize" function places websites like those in your
> Restricted Zone. As of today, there are 188,868 sites that Spybot will
> protect you from.
> http://www.safer-networking.org/
>
>
>
> "Twentiethman" wrote...
> >I was doing a Yahoo search for a Peter, Paul and Mary song "Cruel War" when
> >I
> > was interupted with a message that appeared to come from Windows Internet
> > Explorer. I noted a spelling error and took a screenshot of it to save it
> > for
> > a later enquiry with Microsoft. I clicked cancel and it did a brief,
> > unprompted scan and displayed a "scan result" list with inoperable option
> > buttons and an offer to download Antivirus 2009. I assumed I had to
> > purchase
> > such programs but it said it was free. I became suspicious but hit SAVE
> > instead of RUN. It boxed me in and the X (Close) button only returned me
> > to
> > the RUN or SAVE window. It froze IE so I couldn't reach my Task Manager. I
> > consulted with my son and he recognized the name "Antivirus 2009" as
> > "rogue
> > software" or "malware". He hit ALT+F4 and released IE.
> >
> > I now have Antivirus 2009 downloaded but not yet installed.
> >
> > I now have a screenshot of the original "Windows Internet Explorer"
> > message
> > that encludes a spelling error, peculiar syntax and the word "behaviour"
> > which makes me suspect it originates in Great Britain or Europe.
> >
> > I thought there was a place to report such things to Microsoft, but where?
> >
> > I understand there are several programs available that will remove
> > Antivirus
> > 2009 but I also understand there are legitimate programs going by that
> > name.
> > This one uses the same Security Shield as Windows Firewall.
> >
> > I'm going to keep my downloaded Antivirus 2009 as both a souvenir and as
> > evidence.
> >
> > One would think Microsoft would have a Crimestoppers Section - a place
> > easily reached to report such activity and get a clear cut explanation of
> > the
> > issue.
> >
> > Follow the music.
> >
> >
> > ----------------
> > This post is a suggestion for Microsoft, and Microsoft responds to the
> > suggestions with the most votes. To vote for this suggestion, click the "I
> > Agree" button in the message pane. If you do not see the button, follow
> > this
> > link to open the suggestion in the Microsoft Web-based Newsreader and then
> > click "I Agree" in the message pane.
> >
> > http://www.microsoft.com/communities...orer. general
>
>
>

Afterthought- I vaguely remember reading somewhere that this virus also has
the potential to interfere with your ability to validate your copy of
Windows. I dont remember any details about it, but for some reason it sticks
out in my mind from when I removed Antivirus 2008.

"Dennis" wrote:

> You can try using a program such as malwarebytes to remove it. It worked well
> for the 2008 version.
>
> "Victor" wrote:
>
> > It's a well-known virus. The pain-in-the-ass effect you noticed is caused by
> > JavaScript.
> >
> > I got caught in this once on someone else's computer and it would not let me
> > out of it's clutches. No matter what button you press, it brings up that
> > screen.
> >
> > At some point, I allowed the download dialog to show itself. This freed up
> > IE from popup windows so on Internet Explorer I could access Tools >
> > Internet Options > Security. From Custom Level, I disabled all JavaScript
> > and VBscript.
> >
> > At this point you can disallow the download and the JavaScript popups will
> > stop. Make a note of the domain name and add it to IE's "Restricted sites"
> > (which you should have set so that script and everything else is disabled).
> > Close your browser window, then re-enable scripts again.
> >
> > To prevent this from happening again, install Spybot Search and Destroy on
> > your computer. The "immunize" function places websites like those in your
> > Restricted Zone. As of today, there are 188,868 sites that Spybot will
> > protect you from.
> > http://www.safer-networking.org/
> >
> >
> >
> > "Twentiethman" wrote...
> > >I was doing a Yahoo search for a Peter, Paul and Mary song "Cruel War" when
> > >I
> > > was interupted with a message that appeared to come from Windows Internet
> > > Explorer. I noted a spelling error and took a screenshot of it to save it
> > > for
> > > a later enquiry with Microsoft. I clicked cancel and it did a brief,
> > > unprompted scan and displayed a "scan result" list with inoperable option
> > > buttons and an offer to download Antivirus 2009. I assumed I had to
> > > purchase
> > > such programs but it said it was free. I became suspicious but hit SAVE
> > > instead of RUN. It boxed me in and the X (Close) button only returned me
> > > to
> > > the RUN or SAVE window. It froze IE so I couldn't reach my Task Manager. I
> > > consulted with my son and he recognized the name "Antivirus 2009" as
> > > "rogue
> > > software" or "malware". He hit ALT+F4 and released IE.
> > >
> > > I now have Antivirus 2009 downloaded but not yet installed.
> > >
> > > I now have a screenshot of the original "Windows Internet Explorer"
> > > message
> > > that encludes a spelling error, peculiar syntax and the word "behaviour"
> > > which makes me suspect it originates in Great Britain or Europe.
> > >
> > > I thought there was a place to report such things to Microsoft, but where?
> > >
> > > I understand there are several programs available that will remove
> > > Antivirus
> > > 2009 but I also understand there are legitimate programs going by that
> > > name.
> > > This one uses the same Security Shield as Windows Firewall.
> > >
> > > I'm going to keep my downloaded Antivirus 2009 as both a souvenir and as
> > > evidence.
> > >
> > > One would think Microsoft would have a Crimestoppers Section - a place
> > > easily reached to report such activity and get a clear cut explanation of
> > > the
> > > issue.
> > >
> > > Follow the music.
> > >
> > >
> > > ----------------
> > > This post is a suggestion for Microsoft, and Microsoft responds to the
> > > suggestions with the most votes. To vote for this suggestion, click the "I
> > > Agree" button in the message pane. If you do not see the button, follow
> > > this
> > > link to open the suggestion in the Microsoft Web-based Newsreader and then
> > > click "I Agree" in the message pane.
> > >
> > > http://www.microsoft.com/communities...orer. general
> >
> >
> >