Member Avatar for Carlmundo

Strange question I know. But I'm working on a removal tool for this one piece of malware alone. Reason being this is becoming a problem with some computers my company supplies as I work in IT Support.

A lot of people may argue it's better just to use a malware removal program for this but a lot of the time customers have old machines with 4 years worth of temporary internet files which take ages to remove.

So does anyone know where or how I can obtain this particular program as I need an infected computer to test on.

  • 4 Contributors
  • 5 Replies
  • 194 Views
  • 11 Months Discussion Span
  • Latest Post Latest Post by ****

Dani AI

Generated

Short, practical guide for testing a "Personal Antivirus" style scareware without putting production machines at risk.

Reproducing these infections by randomly browsing or using P2P is unnecessary and dangerous — Personal Antivirus is a known rogue/scareware family that shows fake alerts to trick users into paying or installing more malware. Use vetted analysis material instead of live, uncontrolled infections. (bleepingcomputer.com)

If you need a live sample for a removal tool, build a repeatable lab first. Create a throwaway virtual machine on a dedicated host, take a clean snapshot, and lock down the VM: disable shared folders, clipboard/drag‑and‑drop and any guest integration that increases attack surface. Keep the test VM on an isolated host‑only or NAT network (avoid bridged), and use a simulated internet service for dynamic analysis so the sample cannot phone home to real hosts. Follow snapshot/rollback discipline so each test run starts from the identical baseline. (sentinelone.com)

Obtain samples only from reputable, research‑oriented repositories or sandboxes that provide access under clear terms (do not harvest from random downloads or P2P). These platforms let you download vetted hashes or run files in the cloud without touching your network. Register and follow each service’s rules and use their vetting/metadata rather than trusting a single detection. (bazaar.abuse.ch)

Capture evidence before and after infection: process and registry traces, scheduled tasks, startup entries and file hashes. Tools such as Process Monitor and Autoruns are standard for recording runtime activity and persistence points; save logs and the VM snapshot to reproduce findings when building your remover. After testing, revert the snapshot or destroy the VM — do not reuse the image. (learn.microsoft.com)

Notes tied to this thread: ’s goal of a focused remover is valid for scale, and / raise sensible cautions about existing fixes — use those cautions to keep your lab safe and your tests reproducible. ’s note about variants that recreate themselves underscores the need for snapshot discipline and comprehensive artifact capture.

Recommended Answers

All 5 Replies

Member Avatar for kaninelupus

To be honest, good luck finding it, esp as most modern browsers (which have built-in site alerts) would likely block any sites actually providing it.

To be honest, why are you re-building the wheel anyhow; Malwarebytes actually has a perfect strike-rate in dealing with this little buggar.

Gotta be a lot easier ;)

Member Avatar for Carlmundo

I use MalwareBytes myself and am aware of how good it is. It's a great program but most of our customers have heaps of temp files which takes an eternity to clear, especially if they are on old machines.

My program I want to test is purely just in the interest of saving time. It seems that theres a possibility that it comes from a third party application from Facebook, but then again a lot of people use it.

It had been reported from an Ad from within "FarmTown" and some customers had this. However, on my test machine after clicking ad after ad there is no luck in getting it.

Member Avatar for kaninelupus

It had been reported from an Ad from within "FarmTown" and some customers had this. However, on my test machine after clicking ad after ad there is no luck in getting it.

Well, given that my wife has an addiction with "FarmTown" - and half her family - and none have reported infections... which I'd be left to fix - it may well have been sourced and removed at some point.

Did have a thought. Try looking on Limewire. Given that almost every search seems to bring upteen-dozen malware-loaded results, you might actually hit the jackpot that way. Just a thought :)

Member Avatar for jholland1964

Strange question I know. But I'm working on a removal tool for this one piece of malware alone. Reason being this is becoming a problem with some computers my company supplies as I work in IT Support.

A lot of people may argue it's better just to use a malware removal program for this but a lot of the time customers have old machines with 4 years worth of temporary internet files which take ages to remove.

So does anyone know where or how I can obtain this particular program as I need an infected computer to test on.

I find this entire discussion somewhat suspicious, especially from a supposed IT person who should know better.
Trying to remove this type of infection but NOT remove temporary internet files is really a silly way to go, many of these infections are IN the temporary files.
There is no reason that it would or should take ages to remove temporary files, even supposedly 4 years worth. There is NO way there would be 4 years of temporary files on a computer. There is only so much disk space alloted to temporary files, when that fills up the oldest would drop off anyway.
Remove them, either by using the browser itself or using Disk Clean up or using a program like CCleaner or ATF-Cleaner. It will not take ages to remove them.
As stated earlier, and also acknowledged by you, MBA-M is THE way to remove this family of infections, AND it can and does work without removing temporary files first so honestly this is a moot point. Use MBA-M.

Member Avatar for ****

Dont downlad that one its as simple as that because that hide a component (I'm a expert)in C:\ somewhere that manages to reinstall itself. Find an other one except from:
Personal Security, Personal Antivirus and Antivirus7 there are all different versions of each other and they do exactly what Personal Antivirus does (Recreates itself)

commented: Totally cofusing post. Poster has no idea what he claims. -1
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.