A reboot in safe mode and a system restore to a point last week fixed it, but just to make sure I downloaded the recommended utilities to scan and did a full one. Took well over an hour, but it found 11 other threats from this bastard of a virus.

It seems to lie dormant until you make a change (install software or hardware) and that is what kicked it off.

So even if you “buy” it like a sucker I was, it will return for more. Give it three months if that is the package you bought. You will get hit again if you do not remove it completely.

I made the decision to then just bite the bullet and purchase the “software” and take followup action as needed. Kind of ironic turn of events for the vendor, but I love a good irony. I plunked down the $49.95 on a low-balance debit card, and the bogus AV program loaded like a charm…lo and behold..I SOON HAD MY PC BACK!

First stop: Google, which was inundated with various warnings (now they tell me!) and suggested remedies in tons of blogs just like this one.

Malwarebytes free version did the trick, and I also went into my registry and manually edited / deleted remaining affected files. PC was back to normal in a couple hours, faster than before actually, thanks in part to the registry scrub. Then my only remaining business was to wait for the transaction to clear at my bank; after a 10 minute phone call to claims dept today, I had my $49.95 back.

I politely emailed the vendor via reply to the purchase confirmation and advised I deleted their “product” and was blocking the transaction. I do not expect a reply.

Malwarebytes’ Anti-Malware 1.46
http://www.malwarebytes.org

Database version: 4158

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.13

5/31/2010 11:12:36 AM
mbam-log-2010-05-31 (11-12-36).txt

Scan type: Full scan (C:\|)
Objects scanned: 241506
Time elapsed: 25 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cogogtsk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Rich\Local Settings\Application Data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AE12167-80ED-4D49-B20A-FB366B68C698}\RP316\A0049051.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9AE12167-80ED-4D49-B20A-FB366B68C698}\RP316\A0049052.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rich\Local Settings\Temp\e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rich\Local Settings\Application Data\wfusqcpfm\inojtqjtssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.