Malware warning - Green Anti-Virus (green av)

[jw7]

So normally I am really good about not downloading stuff from untrusted sites, but for some reason I must have had my head up my ass and downloaded a free trial.

It is a nasty, nasty program that messes with your registry and hijacks your browser. Stay away from it.

It looks like I finally got it removed but it required that I had to clean my registry, delete programs from hidden files, and reinstall firefox.

I feel stupid, but at least heed the warning. Avoid this at all costs.

 

[Russ Smith]

So normally I am really good about not downloading stuff from untrusted sites, but for some reason I must have had my head up my ass and downloaded a free trial.

It is a nasty, nasty program that messes with your registry and hijacks your browser. Stay away from it.

It looks like I finally got it removed but it required that I had to clean my registry, delete programs from hidden files, and reinstall firefox.

I feel stupid, but at least heed the warning. Avoid this at all costs.

I was in Sacramento this weekend and was checking my gmail at my girlfriend's brothers house. They have this exact thing it keeps saying green AV is not registered and is trying to get you to click in something to register.

The browser kept closing I think it was some windows feature trying to stop this. It sounds like it disables your real antivirus?

Do you have any suggestions on where to get step by step instructions to remove this, I think I'm going to end up being the one that tries that, her brother doesn't know that stuff and he's got 4 boys 13-18 and a 14 year old girl living in the house so you know they are on the internet quite a bit.

 

[jw7]

Do you have any suggestions on where to get step by step instructions to remove this, I think I'm going to end up being the one that tries that, her brother doesn't know that stuff and he's got 4 boys 13-18 and a 14 year old girl living in the house so you know they are on the internet quite a bit.

Yeah, this is very difficult and I wasted a day trying to figure the out. You can google on "remove green AV" but a lot of the instructions are worthless because it seems they are changing file names.

There are 4 things you need to clear: Registry entries, processes running, software and browser redirects.

1) Go to your task mgr (ctrl-alt-delete) and delete the process named gra.exe or green(something).exe to stop it from running.

2) Go to malwarebytes.com and download their software. It is free and the only thing that killed the registry entries. Neither Spybot nor Spy doctor caught them. Malware did.

3) Go to explorer and search on "green" or "gra" in the search box in the upper right if using Vista. You need to change your file options because the Windows ProgramData folder is hidden. Go to Tools -> Folder Options and make sure to switch the radio button to show hidden files.

4) Delete everything under the ProgramData gra directory or whatever version you have of this.

5) If you are using firefox as a browser, reinstall it. You can save your bookmarks using the export-import function. The malware did not seem to hijack IE, at least not for me.

 

[Russ Smith]

Yeah, this is very difficult and I wasted a day trying to figure the out. You can google on "remove green AV" but a lot of the instructions are worthless because it seems they are changing file names.

There are 4 things you need to clear: Registry entries, processes running, software and browser redirects.

1) Go to your task mgr (ctrl-alt-delete) and delete the process named gra.exe or green(something).exe to stop it from running.

2) Go to malwarebytes.com and download their software. It is free and the only thing that killed the registry entries. Neither Spybot nor Spy doctor caught them. Malware did.

3) Go to explorer and search on "green" or "gra" in the search box in the upper right if using Vista. You need to change your file options because the Windows ProgramData folder is hidden. Go to Tools -> Folder Options and make sure to switch the radio button to show hidden files.

4) Delete everything under the ProgramData gra directory or whatever version you have of this.

5) If you are using firefox as a browser, reinstall it. You can save your bookmarks using the export-import function. The malware did not seem to hijack IE, at least not for me.

Thanks, I found a link http://www.2-spyware.com/remove-green-antivirus-2009.html

It claims it has a removal tool or you can do the registry etc manually it has links below that.

I'm just not sure if that link is reliable or not.

I'm not in Sacramento so I'm trying to find something where I can give her brother the URL and just say click on this, run it etc since it's much easier than trying to talk him through the whole thing. Otherwise it'll be almost 2 weeks before I'm back there to do it myself.

 

[Chaz]

Thanks, I found a link http://www.2-spyware.com/remove-green-antivirus-2009.html

It claims it has a removal tool or you can do the registry etc manually it has links below that.

I'm just not sure if that link is reliable or not.

I'm not in Sacramento so I'm trying to find something where I can give her brother the URL and just say click on this, run it etc since it's much easier than trying to talk him through the whole thing. Otherwise it'll be almost 2 weeks before I'm back there to do it myself.

Good luck with the single link to fix everything. I don't know if any one program that gets everything.

The combo of MalwareBytes Anti Malware and Super Anti-Spyware seems to be the best bet right now.

If the infection is really bad you may need stronger stuff.

Usually the longer it is infected and connected to the internet the harder it is to remove.


Get the above programs and the updates and disconnect the computer from the internet to avoid re-infection during removal.

 

[devilalum]

format

 

[JS22]

So normally I am really good about not downloading stuff from untrusted sites, but for some reason I must have had my head up my ass and downloaded a free trial.

It is a nasty, nasty program that messes with your registry and hijacks your browser. Stay away from it.

It looks like I finally got it removed but it required that I had to clean my registry, delete programs from hidden files, and reinstall firefox.

I feel stupid, but at least heed the warning. Avoid this at all costs.

The only way, in my opinion, to truly get rid of these things is to wipe the hard drive and start over. I would never feel comfortable even if I think I fixed the problem. I consider my AV a warning system. If something is detected (that is not a false positive) I backup my important data and start over.

 

[Russ Smith]

Good luck with the single link to fix everything. I don't know if any one program that gets everything.

The combo of MalwareBytes Anti Malware and Super Anti-Spyware seems to be the best bet right now.

If the infection is really bad you may need stronger stuff.

Usually the longer it is infected and connected to the internet the harder it is to remove.


Get the above programs and the updates and disconnect the computer from the internet to avoid re-infection during removal.

Thanks. So far I've accomplished one goal, I told them NOT to follow the link to renew their AV subscription since that's a ruse by Green AV to steal your credit card number AND upload a virus to your computer. Apparently they were about to try that next so I've stopped that disaster.

For now the links I gave them are a start but I agree probably not a fix. Main problem is nobody seems to know if they have the original CD's that came with the system so formatting may not be an easy option they may not have the necessary software to restore the system.

I probably won't be back in that area for 2 weeks so I'm trying to give them something they can start with and then tell them to unplug from the internet. My concern is I think they're using wireless and I'm not convinced that he can get all the users in the house(teenagers) to not simply plug the wireless back in if he unplugs it. as someone else said, greenav connects back to the internet by itself, it did it while I was using the PC to check my gmail, the browser got jacked on me so I closed it. When I brought up task manager I could see ie was running even though it wasn't showing that it was open, and in fact I'd been using google chrome to get to gmail because I couldn't get the ie to stay open.

Looks like green av hacks your browsers and it appears it's now able to take over chrome since it did it with me.

 

[jw7]

For now the links I gave them are a start but I agree probably not a fix.

Yeah, listen to SirChaz. Spy Doctor in the link you said claimed to remove it, but when I downloaded it and ran it, it did not do Jack Squat.

Malwarebytes worked really well for the registry entries.

Such a pain. If Firefox is hijacked, it is real easy to export your bookmarks, uninstall and download it again. My IE was not hijacked and I would be more uncomfortable re-installing that.

 

[Chaz]

Such a pain. If Firefox is hijacked, it is real easy to export your bookmarks, uninstall and download it again. My IE was not hijacked and I would be more uncomfortable re-installing that.

HiJackThis is the best bet to cleanup IE.

You need to have some idea what to remove though.

 

[JS22]

Why do so many people insist on spending so much time downloading programs, manually trying to fix things, potentially breaking the registry, etc, just to MAYBE get rid of a virus?

Why not just spend an hour wiping the drive and reinstalling Windows? It's the only guaranteed method of removing a virus.

 

[Chaz]

Why do so many people insist on spending so much time downloading programs, manually trying to fix things, potentially breaking the registry, etc, just to MAYBE get rid of a virus?

Why not just spend an hour wiping the drive and reinstalling Windows? It's the only guaranteed method of removing a virus.

Re-installing is the nuclear option. It ain't pretty and the cleanup is a pain but it clears out any resistance in short order.

 

[Russ Smith]

Why do so many people insist on spending so much time downloading programs, manually trying to fix things, potentially breaking the registry, etc, just to MAYBE get rid of a virus?

Why not just spend an hour wiping the drive and reinstalling Windows? It's the only guaranteed method of removing a virus.

I agree my problem is in this instance it's not my computer and apparently nobody knows where any of the original software CD's are. For example my girlfriends laptop came with a CD specifically for if you have to wipe the drive and start from scratch. My PC I have a similar CD(actually bunch of CD's).
But in this case so far nobody knows if there are CD's let alone where. They moved a couple of years ago and apparently nobody has a clue where that stuff would be if they ever had it.

 

[Russ Smith]

So far what I've done is download a copy of malwarebytes to an 80GB external drive I have. That way if I'm unable to get to their site due to green AV blocking it, I can put the machine in safe mode, plug in the external drive and install and run Malwarebytes.

I've been googling on this quite a bit I sure wish they knew where all the CD's were would be much easier to just wipe and reinstall, sounds like there are several different file names you have to find and delete many of them hidden in the startup folder or other folders.

 

[Sandan]

format

Periodicly

 

[Sandan]

Why do so many people insist on spending so much time downloading programs, manually trying to fix things, potentially breaking the registry, etc, just to MAYBE get rid of a virus?

Why not just spend an hour wiping the drive and reinstalling Windows? It's the only guaranteed method of removing a virus.

If you can reinstall in an hour you are a lucky man, by the time I finish reloading and reinstalling programs on a good day its 4+

 

[conraddobler]

Running Vista and Windows Defender and Symantec Endpoint, although I have heard nothing but horror stories about it, I've never had something get actually through and hijack things.

It tries but always gives you the out of permission box.

You can just shut down if you have to if it's stuck, as long as it dosen't get installed it's good.

I've never had a problem but I have seen things try over and over again to get in.

Formating is the nuclear option on some machines, my laptop I could give a care, I just browse the net with it, don't care about anything on it, however if it's a work computer I'd rather take pepper spray in the face than reload.

 

[Russ Smith]

One interesting thing on this. I was using my girlfriends laptop, with Norton AV, and googling information on how to get rid of the Green antivirus.

After I went to one particular site I noticed the computer had REALLY slowed down. So I closed IE and ran a scan with Spyware Doctor and sure enough I had a trojan.32 thingamajig. I'm assuming it got there when I was googling to get rid of the Green thing which I'll probably be doing this weekend in Sacramento.

Spyware doc deleted it(the trojan) but once again I'm alarmed that I can get something like that with NAV installed?

 

[conraddobler]

One interesting thing on this. I was using my girlfriends laptop, with Norton AV, and googling information on how to get rid of the Green antivirus.

After I went to one particular site I noticed the computer had REALLY slowed down. So I closed IE and ran a scan with Spyware Doctor and sure enough I had a trojan.32 thingamajig. I'm assuming it got there when I was googling to get rid of the Green thing which I'll probably be doing this weekend in Sacramento.

Spyware doc deleted it(the trojan) but once again I'm alarmed that I can get something like that with NAV installed?

I've never gotten a virus using Vista and NAV plus windows defender, although our tech that comes out claims it's possible and he sees it quite often.

I do have the corporate version of NAV, realistically it's the same thing although the updates are faster for it.

I won't be buying any more Symantec upgrades, may move to AVG or something of that nature.

 

[Russ Smith]

Well that was a waste of 90 minutes and frankly I feel bad at the outcome.

Computer was crashing the browser over and over when I got there. So I got into task manager and managed to find and kill the process responsible for all the popups. I couldn't seem to find any of the files that I wanted to delete easily but I did find the folder for green av and deleted those files.

Then I discovered it wouldn't let me download any anti virus or antimalware. Malwarebytes, spyware doc etc when I tried to download it said you must be logged in as admin to do that. Her brother swears there is no admin login. I tried 4 different logins including the one labelled HP(brand of the computer) and got the same message each time. Even running malwarebytes from my external HD was blocked.

At that point the computer crashed and I had to reboot it. So I rebooted in safe mode but couldn't seem to do anything, rebooted again and now the computer won't boot. It gets to the screen where it gives you 3 options, esc for a menu, F1 for a boot screen(but it won't boot from that screen) or F10 which is the system restore built in to the computer that restores it to how it was the day it came out of the box. They didn't want me to do that, so eventually he said he'd take it to his work and see what his IT people advised.

I called a buddy of mine who's in IT and he basically said they have to wipe and redo, probably easiest to just use the F10 system restore. He was pretty convinced I hadn't done anything wrong, just when I tried to download any protection, the virus simply did something that locked out the computer entirely. So they're actually worse off now than when I started because they can't boot the PC at all now so I feel bad about that but nothing I can do. They don't have the CD's so the F10 restore is the best option but they didn't want me to do it.

Definitely stay away from this one ,it apparently can be really destructive if given enough time.

 

[conraddobler]

Well that was a waste of 90 minutes and frankly I feel bad at the outcome.

Computer was crashing the browser over and over when I got there. So I got into task manager and managed to find and kill the process responsible for all the popups. I couldn't seem to find any of the files that I wanted to delete easily but I did find the folder for green av and deleted those files.

Then I discovered it wouldn't let me download any anti virus or antimalware. Malwarebytes, spyware doc etc when I tried to download it said you must be logged in as admin to do that. Her brother swears there is no admin login. I tried 4 different logins including the one labelled HP(brand of the computer) and got the same message each time. Even running malwarebytes from my external HD was blocked.

At that point the computer crashed and I had to reboot it. So I rebooted in safe mode but couldn't seem to do anything, rebooted again and now the computer won't boot. It gets to the screen where it gives you 3 options, esc for a menu, F1 for a boot screen(but it won't boot from that screen) or F10 which is the system restore built in to the computer that restores it to how it was the day it came out of the box. They didn't want me to do that, so eventually he said he'd take it to his work and see what his IT people advised.

I called a buddy of mine who's in IT and he basically said they have to wipe and redo, probably easiest to just use the F10 system restore. He was pretty convinced I hadn't done anything wrong, just when I tried to download any protection, the virus simply did something that locked out the computer entirely. So they're actually worse off now than when I started because they can't boot the PC at all now so I feel bad about that but nothing I can do. They don't have the CD's so the F10 restore is the best option but they didn't want me to do it.

Definitely stay away from this one ,it apparently can be really destructive if given enough time.

There are things that can be done even if it won't boot.

It's probably going to be expensive though if they hire someone competent enough to do it, but you can boot using a CD and try and see if you can get any files off it they may need or want.

Then there are utilies that would allow you to edit the registry or even replace it with a clean copy that may be backed up on it.

Like I said it's too complicated to get into but wiping it out probably isn't completely necessary if they really don't want that done, techs say that all the time assuming people have backed stuff up, if you haven't like most people haven't then that's really a sucky option.

Depends on how badly it's corrupted the file system.

If you can boot it into Dos mode even then copy the files over they can spot you can get some uber important stuff off it but again it's not easy.

You can even remove the hard drive and then take it to an expendable computer and by a drive enclosure and see if they can see the volume on it and copy stuff over that way.

If it's just bothering the operating system and has destroyed that then if you buy the drive enclosure, plug it in to a computer you don't mind infecting, cause it could, then you could simply see if you can work with the files, the computer will have already booted up before you plug it in, the USB connection allows you to see the drive even though you didn't boot with it and sometimes you can get pictures and important files off it that way.

It really depends on what the virus attacked, if it corrupted the volume it's all gone, makes a difference too if it's NTFS or FAT, if it's newer it's probably NTFS.

If it's a FAT file it's most likely toast by now.

If you can boot up in a different operating system you might be able to see the files or it might have locked down the entire volume requiring a admin password you won't know.

You didn't do anything wrong though, that's what it's designed to do when messed with, they have sophisticated antivirus routines in them that won't let you attack it that way.

 

[Chaz]

Well that was a waste of 90 minutes and frankly I feel bad at the outcome.

Computer was crashing the browser over and over when I got there. So I got into task manager and managed to find and kill the process responsible for all the popups. I couldn't seem to find any of the files that I wanted to delete easily but I did find the folder for green av and deleted those files.

Then I discovered it wouldn't let me download any anti virus or antimalware. Malwarebytes, spyware doc etc when I tried to download it said you must be logged in as admin to do that. Her brother swears there is no admin login. I tried 4 different logins including the one labelled HP(brand of the computer) and got the same message each time. Even running malwarebytes from my external HD was blocked.

At that point the computer crashed and I had to reboot it. So I rebooted in safe mode but couldn't seem to do anything, rebooted again and now the computer won't boot. It gets to the screen where it gives you 3 options, esc for a menu, F1 for a boot screen(but it won't boot from that screen) or F10 which is the system restore built in to the computer that restores it to how it was the day it came out of the box. They didn't want me to do that, so eventually he said he'd take it to his work and see what his IT people advised.

I called a buddy of mine who's in IT and he basically said they have to wipe and redo, probably easiest to just use the F10 system restore. He was pretty convinced I hadn't done anything wrong, just when I tried to download any protection, the virus simply did something that locked out the computer entirely. So they're actually worse off now than when I started because they can't boot the PC at all now so I feel bad about that but nothing I can do. They don't have the CD's so the F10 restore is the best option but they didn't want me to do it.

Definitely stay away from this one ,it apparently can be really destructive if given enough time.

The registry sounds completely corrupted. This happens if it is infected and on the internet for any length of time.
At this point even if you remove all the viruses windows will probably still be "broken" (random error messages and such) because of the damage the viruses have done.

They have essentially locked them out of their own computer.

Like Conrad said, plug the Hard drive into a USB case and salvage what data you can.

 

[Russ Smith]

The registry sounds completely corrupted. This happens if it is infected and on the internet for any length of time.
At this point even if you remove all the viruses windows will probably still be "broken" (random error messages and such) because of the damage the viruses have done.

They have essentially locked them out of their own computer.

Like Conrad said, plug the Hard drive into a USB case and salvage what data you can.

THat's what happened to mine when I got the antivirus 2009 virus. It eventually locked me out, when I booted up it asked for a password that didn't exist. My IT buddy at work used a knoppix disk to copy files off for me, wiped it and then I reinstalled. I had the CD's, my girlfriend's brother doesn't so he'll have to use the F10.

I think you and Conrad are right I think the registry is hosed I suspect that deleting some of the virus files, but not all, "breaks" registry entries that is when the machine boots up it runs the virus in the startup and since I deleted those files, it won't boot? I never tried to edit the registry and since I couldn't download malwarebytes to run it, I wasn't able to use that which apparently fixes the registry.

Felt really bad but I think her brother understood that I did what I could.

 

[Chaz]

THat's what happened to mine when I got the antivirus 2009 virus. It eventually locked me out, when I booted up it asked for a password that didn't exist. My IT buddy at work used a knoppix disk to copy files off for me, wiped it and then I reinstalled. I had the CD's, my girlfriend's brother doesn't so he'll have to use the F10.

I think you and Conrad are right I think the registry is hosed I suspect that deleting some of the virus files, but not all, "breaks" registry entries that is when the machine boots up it runs the virus in the startup and since I deleted those files, it won't boot? I never tried to edit the registry and since I couldn't download malwarebytes to run it, I wasn't able to use that which apparently fixes the registry.

Felt really bad but I think her brother understood that I did what I could.

Exactly, the virus creates registry entries to embed itself into Windows. Remove the infected files and windows won't boot or throws error messages because files are missing.

It sucks to give someone bad news but it isn't your fault they got a virus.

The trick is to get to it quickly and disconnect the network at the first sign of trouble. After weeks gone by it is pretty much unrecoverable without much more effort than it takes to format and start over.

 

[conraddobler]

Exactly, the virus creates registry entries to embed itself into Windows. Remove the infected files and windows won't boot or throws error messages because files are missing.

It sucks to give someone bad news but it isn't your fault they got a virus.

The trick is to get to it quickly and disconnect the network at the first sign of trouble. After weeks gone by it is pretty much unrecoverable without much more effort than it takes to format and start over.

Yep, typically when people start looking funny at you it's because they have something on their hard drive that isn't backed up.

In that case if it's important enough then bother trying to see if you can access it, if not, just reformat, I'm sure it's possible to fix the registry it's just so not worth the effort.

Truth is in this day and age any infection leaves a computer suspect, I would only mess with it having the goal of it being easier to get to my files that way then removing the drive, once you establish that's not the case then you're just after the files and once you either have them or know they're gone then reformat.

I'd never trust it again anyhow, even if I fixed it well enough to get by.