How do I get rid of Windows Antivirus Pro?

[dudalb]

I managed to download this malware. It shusts down my legit AntiVirus Program (Norton's Antivirus) and bombards me with messages asking me to purchase the full program. I have tried to download some programs that will remove it, but it blocks those programs. How do I get rid of this thing?
The dangerous part is that it totally disables my legit protection systems.
It's clever, I will give it that. I even tried to go to Wikipedia to get some info, but is said I had blocked that site for security reasons..and,needless to say ,there is no way of changing that.
HELP!

[dtugg]

I would try booting into Safe Mode. If you do that, the malware probably won't load. Then turn off System Restore because these things can back themselves up in there, then run the AV scan. I hope this helps

[tuc0]

My advice is to google it on a different computer in case it blocks you. There are tons of sites on how to do it.

The first three hits:

http://www.xp-vista.com/spyware-removal/windows-antivirus-pro
http://www.bleepingcomputer.com/virus-removal/remove-windows-antivirus-pro
http://www.2-spyware.com/remove-windows-antivirus-pro.html

[Dancing David]

Safe mode with networking, open task manager, look for abnormal processes and end them,malwarebytes and superantispyware

tuc0 nailed it as well.

[kbm99]

http://www.malwarebytes.org/mbam.php

Probably blocked; you may need to download from an uninfected computer.

[Dancing David]

http://www.malwarebytes.org/mbam.php

Probably blocked; you may need to download from an uninfected computer.
Safe mode with networking will usually get around that. If you see the process in the task panel, you can kill it for sure.

[Monketey Ghost]

I thank everyone who starts these threads... they help me avoid trouble.

[dudalb]

I just found out that the latest mutation of this virus basically disables most of the methods described above. It has also corrupted my rundll32.exe so most of my programs do not run.
Very frustrating,and I am really trying to avoid paying a couple of hundred bucks to a tech help person.
I hope the guys in Russia who created this thing rot in hell.
Any ideas on getting my rundll32 file up and running manually? Just cutting and pasting it from my XP installation disc does not help
I am also going to take a hard look at my Anti Virus program (Norton) since they dropped the ball on this one big time.

[NWO Sentryman]

have you tried system restore, or was it affected by the rundll32.exe disability?

If not, try going back a day before the first incidents took place. Then run in safe mode and clean up afterwards.

Worked with me when i removed Zlob.

[Monketey Ghost]

I just found out that the latest mutation of this virus basically disables most of the methods described above. It has also corrupted my rundll32.exe so most of my programs do not run.
Very frustrating,and I am really trying to avoid paying a couple of hundred bucks to a tech help person.
I hope the guys in Russia who created this thing rot in hell.
Any ideas on getting my rundll32 file up and running manually? Just cutting and pasting it from my XP installation disc does not help
I am also going to take a hard look at my Anti Virus program (Norton) since they dropped the ball on this one big time.

Personal: I had NAV for a long time. It worked great, until after the 2003 version.

I had NAV 2009, and it is a totally different ball of whacks... and I got a virus for the first time ever. Took it in and had it cleaned for 90 bucks. The techies removed NAV, installed AVG, Windows Defender, Spybot, and Malware anti-malware. I am a wide-net fisher, and no troubles so far.

I feel like an ass for paying so much for NAV 2009 when freeware does a better job.

[CynicalSkeptic]

a totally different ball of whacks...

That's a Mondegreen I hadn't heard before.

[BobTheDonkey]

Personal: I had NAV for a long time. It worked great, until after the 2003 version.

I had NAV 2009, and it is a totally different ball of whacks... and I got a virus for the first time ever. Took it in and had it cleaned for 90 bucks. The techies removed NAV, installed AVG, Windows Defender, Spybot, and Malware anti-malware. I am a wide-net fisher, and no troubles so far.

I feel like an ass for paying so much for NAV 2009 when freeware does a better job.

Had the same prob with NAV and then with McAfee/AVG co-install. Now use Avast! and haven't had any probs on either computer. Go freeware!

[Monketey Ghost]

That's a Mondegreen I hadn't heard before.

Typed a-purpose. I like it better, it describes the NAV trouble more accurately.

[ohms]

I just found out that the latest mutation of this virus basically disables most of the methods described above. It has also corrupted my rundll32.exe so most of my programs do not run.
Very frustrating,and I am really trying to avoid paying a couple of hundred bucks to a tech help person.
I hope the guys in Russia who created this thing rot in hell.
Any ideas on getting my rundll32 file up and running manually? Just cutting and pasting it from my XP installation disc does not help
I am also going to take a hard look at my Anti Virus program (Norton) since they dropped the ball on this one big time.

Instructions on restoring rundll32.exe from CD are here (http://support.microsoft.com/kb/812340/en-us). Quite often these sorts of malware are introduced via video codes or unpatched vulnerabilities in 3rd party software (Flash player etc). I use Secunia PSI (http://secunia.com/vulnerability_scanning/personal/) to help keep my software up to date and help to avoid these nasties (as well as Firefox+Noscript+Adblock Plus of course;)).

[Dancing David]

I just found out that the latest mutation of this virus basically disables most of the methods described above. It has also corrupted my rundll32.exe so most of my programs do not run.
Very frustrating,and I am really trying to avoid paying a couple of hundred bucks to a tech help person.
I hope the guys in Russia who created this thing rot in hell.
Any ideas on getting my rundll32 file up and running manually? Just cutting and pasting it from my XP installation disc does not help
I am also going to take a hard look at my Anti Virus program (Norton) since they dropped the ball on this one big time.


Ouch. Manual cleaning of the registry won't help that one. Ouch.

Normally I use something like this (this happens at work alot.)
http://www.bleepingcomputer.com/virus-removal/remove-antivirus-pro-2009

After you get it cleaned, you may want to install Windows Steady State, we have tried to booger up machines with it at work (our IT director has a lab full of toxic malware) , so far it has worked, of course it just means you have to turn off the steady state to install anything or change settings. (Like installing printers)

http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx

And not all AV software is updated by it automatically. :(

But we infected machines until they were crashing, restarted and boom they are all better.

[volatile]

My Dad's laptop had an iteration of this, and whilst MalwareBytes got most of the nastiness, the browser remained hi-jacked. Thanks to someone on here, I managed to fix even that: http://forums.randi.org/showpost.php?p=4463055&postcount=21

It really is a nasty, nasty piece of code.