Sophos says there are so many variants being released constantly that it can be difficult to detect using traditional signature-based antivirus, which is what I have. Even with the latest updates, the newest variants can get through. Some variants are also employing polymorphic code, which changes itself so frequently that the MD5 hashes used by antivirus programs cannot be effective. Well, that explains how I got it despite having a good, up-to-date antivirus product.

Earlier versions of FakeAV required the user to say "Yes" to something, such as a fake video codec installation to play a video or a fake Flash player update. Some even use the old-fashioned, tried-and-true technique of attaching the installer to a spam email notifying users of a password reset, package delivery or IRS refund, which I see a lot of at the office. But none of these is how I got infected. I was searching on . Search terms are being "poisoned" on Google. When an unsuspecting victim clicks on what seems to be a legitimate page, he is brought instead to a compromised website where the malware is lurking in an image or JavaScript code. When I'm searching on Google, I use CTRL-click to open interesting results in a new tab in Internet Explorer Version 8 (fully patched). Last week, when I did this, one of the pages I opened must have contained the JavaScript or image version. It opened in a new tab, where I left it for later viewing, and it infected my system. Pop-ups appeared, all my sessions closed, and my antivirus programs were disabled. This is what's known as a "drive-by download."

Now that I know what I'm up against, I tried running three different antivirus and malware-cleanup utilities I already have on my system. None of them worked. In fact, they wouldn't even start. I then tried killing the malicious process, but I couldn't find it (it's well hidden). I did find an entry in the system registry to run the malware installer on reboot, but when I deleted that, it was back after the next reboot. Next, I tried to boot into safe mode, and that's when my computer went completely dead. It wouldn't boot at all. Even booting from the operating system CD didn't work.

As it turns out, this malware went really deep. Not only did it infect Windows, but it also inserted itself into Safe Mode. Usually, we can boot into Safe Mode to run a scan, but not this time. In fact, I discovered that the malware actually got into my system BIOS. That's right, it went so deep it actually got into my hardware. Even a BIOS upgrade didn't get rid of it.

In the end, I had to disconnect my CMOS battery for a day to clear the BIOS, completely reinstall Windows and restore from backup. Unfortunately, during my initial restore attempts, the system crashed in the middle of the restore process, which corrupted my backups. I lost my two most recent backups that way, so now I'm running on a six-month-old version. So there was collateral damage.