My husband picked up this godawful file . . . I was able to stop it through task manager, but it came back after shutdown and restart this morning. It is a program that tells you your system is infected, regardless of what file you are trying to open. If you respond to the pop up that you want to block the infection, the browser automatically opens goes to url osawarepro.com to buy an anti-virus program, "AntiVirus System Pro". This piece of garbage got through Sunbelt Personal Firewall. The program puts a blue shield in your system tray with a white banner through it. I was able to end the application last night. Today I can't get rid of it. I can only identify it by the file added to C:\Program Files\qqwyvk which contains lgrrsysguard identified with a camera icon. Neither can be deleted or moved to the recycle bin. lgrrsysguard is an application file. Very real looking Windows Security Alert comes up that says:
"Windows Security alert
Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan you computer. Your system might be at risk now" (EXACT WORDING)
Various alerts come up claiming your computer is being attacked, then asks if you want to block the attack (yes or no). If you say yes, ie connects to the osawarepro.com site trying to get you to buy the program (doubtful any exists) for 49.95. Another screen says there are 34 infections on your computer. The osawarepro.com screen says your computer may be infected, of course, and buy now. This is very malicious and annoying!!! Pop-ups are blocked through ie and Sunbelt Personal Firewall, but it makes no difference with this program. I've also blocked the junk that pops up as part of this sequence: porno.org, viagra.com and some erectile dysfunction site. The site pages don't look real either....just annoying looking enough to get you to send them money. Whatever!
This program is blocking my System Restore too. I can eventually get into it, but the system restore page is blocked. Has anyone dealt with this one before?
