Win2K SP4, IE6
ZoneAlarm Security Suite (latest)
Home page hijacked to http://scanner.vav-xscanner.com

This is my sister's computer and she lives about 120 miles away. There is NO CHANCE of her doing anything to resolve this problem so I'm hoping that I can go down there armed with some programs (?) and knowledge to get her machine cleaned up.

ZoneAlarm does not detect any problems. Are there any online virus scanners that will help? Are there any programs I can download and run that will help? I would like to get it resolved at one sitting so I don't have to make multiple trips down there. I love my sister but not enough to drive down there for just a few hours of work. On the other hand it has to be resolved. So where do I begin?

Hello Apollo, welcome to PCHF.

It's most likely a malware issue. Using something like Spybot Search and Destroy *may* find your problem. This is not great, but it's free. There is no software which is guarentee'd to fix this particular issue, so instructing you to purchase software which may/may not work is not something we do here.

However, your best chance of success or if this software fails is to follow PCHF Prework on my signature, and post a HiJackThis log for a member of security to analyse. (you could send the instructions listed there over to your sister to see if she is able to follow them, and send the log to you. It's quite easy.) Better than any software you can buy, and if there is malware present on your sisters PC, then our Security team will find it. The downside to this is that if your sister is unable send the log to you, then you may end up doing this in two visits after all.

Madmonkey, Thanks for the info. I downloaded HiJackThis and DSS from your prework page. I've also read the prework page and I'm sorry to admit that it will be an excercise in frustration for both me and my sister if I try to walk her through the prework. So, I'll have to wait for 08/02/08 when I'm going over to her place.

A little more information. I'm not sure but I think the "vav" I'm referring to stands for "Vista Anti-Virus" - the bogus anti-virus that's floating around on the 'net.

I've also run across a program, on this forum I think, called "SpyHunter" that claims to remove all traces of "Vista Anti-Virus" from a computer. Its instructions can be found at http://www.removal-instructions.com/removeVistaAntivirus2008.html. Do you know anything about this?

I'm not sure. I don't personally use Spy Hunter, but have received mixed reports about this software. A friend of mine swears by it. I'll ask the Security team what they think.

Vista Antivirus 2008 is more fake anti-spyware, the evil twin of Antivirus2008 (which is the ******* clone of PCcleaner). Like this other fake antispyware, Vista Antivirus 2008 might launch pretend system alert popups. This Vista Antivirus 2008 popup is supposed to scare you into buying Vista Antivirus 2008.

SpyHunter is controversial at best. I have personal doubts about its capabilities, so I would suggest you stay away from it.

SuperAntiSpyware, on the other hand, has been known to be pretty effective in removing these rogue anti-spyware programs. If you cannot run the Prework and post the logs in the forums, I would say this is the best bet you can get.
SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!


Let us know how it goes.