A very common, very annoying and very sneaky type of virus is the fake antivirus also called Rogueware . Everyone should have happened to surf the internet and see a banner appear that says " your computer is infected with viruses, scan with this free antivirus ". This is a false warning that misleads users into paying for a fake or simulated malware removal program or, worse, installing other malware. Once the computer has been infected with rogueware, it either downloads real viruses or simply simulates that the computer has been infected and offers a paid repair tool. Even if, in this second case, the detected viruses are not real, it is a blackmail and the PC is taken hostage: either download this antivirus or the infection warning will continue to appear, paralyzing every activity. What's worse is that these fake antiviruses are designed to disable the real antivirus installed on your computer which then becomes ineffective.
READ ALSO: 10 Anti-Ransomware against Ransom virus or Crypto
I previously wrote about how to remove malware, spyware and fake antivirus viruses with a manual procedure based on portable programs but, you can do it first with a unique solution designed for this problem: RogueKiller .
RogueKiller is a free and portable tool that scans the registry and running processes, terminating the malicious ones. RogueKiller disables the fake antivirus without deleting files on the computer. After using RogueKiller it will be possible to reuse your real antivirus or other malware removal tool. Opening RogueKiller you will notice an unfriendly, very Spartan interface that could scare the less experienced.
In reality, its use is very simple: just press the 1 key on the keyboard to start the scan . A log file with the name RKreport.txt will be created, saved in the same location as the RogueKiller program. If the warning of registry entries found infected appears, with button 2 you can eliminate the fake antivirus and disinfect the PC . Suspicious files are copied to the RK_Quarantine folder while the original file is still available in the original location and will have to be removed with another program (SuperAntispyware can be used) or manually. To make RogueKiller work, you need to start the program as an administrator (right click -> run as administrator).
Another program to eliminate fake antiviruses is ESET Rogue Application Remover which is able to undo changes made by rogue applications (fake) in the Windows registry.
ESET Application Rogue Remover is a small program to be run with administrator rights (right click on the file and then run as administrator) and on a computer connected to the internet. The scan is very fast and finds all suspicious programs that need to be removed or quarantined.
A third program to use to find and remove fake antivirus or other software that blocks your Windows PC by taking it hostage with fake error warnings is Trend Micro's Fake Antivirus Remover . The software can detect and remove fake antivirus like: Additional Guard, Advanced Defender, AKM Antivirus, AlphaAV, Anticare, Antivir64, BlueFlare Antivirus, bug doctor, BootCare, CleanV, Cyber Security, Data Protection, Ddos Clean, Dr, Guard, Easy Scan, HDD Fix, Infor-Safe, Malware Defense, LightClean, Privacy PC just to name a few. During the first run, it is advisable to run a full scan, wait for the end and check the results of possible threats detected. With the Clean button you can move it to quarantine.
A list of fake antivirus, I don't know how updated, is on Wikipedia.
If you have been affected by a fake antivirus, it means that you are unfamiliar with computer security programs and you should read the article on the best antivirus to see which are the most reliable names.
In another article, the complete guide and tools to remove the effects of viruses that take the PC hostage
