Antivirus8 or Antivirus 8 is a rogue anti-spyware program from the same family as Antivirus 7. This rogue is promoted through web sites that pretend to be online anti-malware scanners, but are instead advertisements that when finished state your computer is infected. This fake scanner will then prompt you to download and install Antivirus8 on to your computer in order to protect it. It should be noted that these fake online scanners are just an advertisement that have absolutely no way of knowing what is running on your computer. In fact they will show the same infection results to anyone who visits the page. Therefore, do not be concerned by what these online scanners show you.

You need to visit the forum below, you have a rogue anti-spyware program

Here is a link that might be useful: Malware help.

Or take it back to bestbuy and have the infection removed.

my guess is best buy will just reformat it as that is what they do 90% of the time.

She got it from a website she visited or possibly from a social networking site, these infections are unfortunately popping up a lot. They are very difficult to remove with out the use of a special forum like the one zep linked to.

There should not be a problem with her router.
She needs to keep malwarebytes and update and run it weekly, make sure her antivirus program is active and updated also and scanning. She should have the windows 7 firewall turned on if she does not have a 3rd party firewall on the laptop. I would also suggest she add spywareblaster to all of her computers, no scans to do just open it weekly to update then enable all protection for a green shield.
SpywareBlaster
be sure to continue with the free download.

to understand how many of these rogue's are out there just take a quick look at this blog that tracks them
http://siri-urz.blogspot.com/

Here is a link that might be useful: blog

Thank you for your comments. I talked to her this morning and she was doing a remote Geek-Squad check. (They live way out in the back country.) She did backup everything she could on cd's so if they do reformat she will be ok.

ravencajun,
I wondered about the router because I'm not sure if she has it setup with properly. I told her to besure and ask the tech about that. I thought that if a router is set up correctly it would guard against this type of Drive-By attacks.

Not very likely a router problem. Far more likely she clicked on a link she shouldn't have or wandered by a web site that was malicious (something as simple as a misspelled word can do that).

Before she runs to Best Buy, she might want to reboot into safe mode and run her malware scanner(s) there.

well it is very important to have the router set up properly with the highest security possible, that is so that no one can gain access to the wireless network, if she is not using wireless then not an issue.
Routers also contain a hardware firewall which is beneficial but a software firewall should still be used in addition.
But no the router will not stop drive by infections.

We already know what the issue is, it's Anti Virus 8. There's a clear set of removal instructions I will not post here cause I want the user to get experienced help with it. A clear set of registry entries that get changed etc.

Running a malware scanner in safe mode is a crap-shoot it may clear the symptoms but not remove all the infected files, so you can't confirm to the user that the machine is clean.

msm84,

When your Grand daughter "x-ed" it out. That may have been how it got installed after visiting a bad website. NEVER X OUT or even touch the screen with your cursor/mouse on a popup of this type. What you want to do is to left click the taskbar and bring up the Task Manager and end the process. This type of Rogue program is called Scareware. It entices you to purchase the program to remove malicious content that is fictitious. This is a complete scam as the scan results are all fake and many of the listed files are actually legitimate files that if removed could cause problems for your computer.

Antivirus 8 will also attempt to protect itself by not allowing you to run various programs that may assist in removing it. When you attempt to run these types of programs, Antivirus8 will terminate it and then state that the file is infected.

In conjunction to installing SpywareBlaster, I also recommend her to install WOT (Web of Trust). This will prevent access to bad sites as long as you heed the warnings to not enter them. Self discipline is the key to prevention!

Please follow through with getting professional help before installing anything more. Even if you use MBAM in safe mode, there is still a registry key that will be needing attention! These programs are very aggressive and do leave traces behind.

Good Luck!

bbbluz

Here is a link that might be useful: WOT Free download

Thank you bbbluz! You brought up some very good points. I did tell her that clicking on anything could also install and to bring up the task manager instead. Also I don't know about this thing, but most programs can be closed by right clicking on them in the taskbar and click either exit or close.

I had also told her she needed to install Firefox and WOT and have sent her the links. She did say she was on google doing some research when this happen so it was a bad link. These kids just don't learn. It was just 8 months ago I paid to have her desktop cleaned and then gave her the money for the new laptop for graduation. Geeez!

msm84 I feel your frustration! One thing we can not fix is the user LOL they have to be the one to fix that!

However I have now informed all of my family members that as long as any of them are on facebook or using the social networking sites I specifically warned them not to use, then do not even bother calling on me for help, and I have stood by that. I have provided all the programs they need to have on the pc to keep it maintained and told them how to use them to scan, beyond that they are on their own.

However I have now informed all of my family members that as long as any of them are on facebook or using the social networking sites I specifically warned them not to use, then do not even bother calling on me for help, and I have stood by that.

But if they get a infected visiting a porn site, you'll help them? ;-)

Facebook or any other the other social networking sites don't want their customers getting viruses because they make money when people visit their sites, not go somewhere else. It's just like the big porn sites, they want your money and making people angry isn't a good way to get them open their wallets.