Rogue Antivirus masquerades as AVG Antivirus

Topic

New Reply

Rogue:Win32/FakeXPA, another of those fake rogue malware critters, has stolen the AVG logo to use on their pop-ups within browsers. It looks alarmingly real. Check out the details here on Softpedia.

It should be obvious if you see a pop-up and you do not use AVG Antivirus 2011. But for those who do have it installed, it only takes a moment to be caught with your proverbial pants down.

Reply | Quote

Replies

When will people ever learn to NEVER NEVER NEVER…click on popups…

Reply | Quote

Here is the page explaining about AVG Antivirus 2011 rogue malware. Halfway down are the removal instructions with safe and free removal instructions.
http://www.bleepingcomputer.com/virus-removal/remove-avg-antivirus-2011

Reply | Quote

I am not even sure that you need to click the darn thing. I was on a page which I cannot even remember what it was, and all of a sudden had a supposed scan being run, which, in less than a second, told me my PC had viruses. Of course, I immediately realized it was one of these rogue apps, so I closed the browser window and the issue was gone. But I must say that I didn’t click it, at least not explicitly, I know a bit better.

Reply | Quote

I just got this.

http://www.howtogeek.com/howto/43090/heres-a-super-simple-trick-to-defeating-fake-anti-virus-malware/

Reply | Quote

The longer the bug is out there, the more fixes become available.

Reply | Quote

A good way to send malware like that packing is to close the browser window by right clicking the Taskbar, selecting Task Manager, Processes tab, and right click the browser executable and select End Process. That way there is absolutely no clicking inside the affected browser.

Reply | Quote

Yes, whenever I suspect something I always close my browser using the task manager.

Reply | Quote

Interesting, but I came home Friday and my wife had the AVG bug on her laptop. I closed the popup with taskmanager, ran rkill – it found two trojans, then ran malwarebytes and rebooted the laptop. AVAST did a boot up scan and found nothing.

the trojan prevents malwarebytes, SAS and the antivirus from removing the package.

Reply | Quote