free virus removal tool for Antivirus System Pro

Antivirus System Pro is a rogue, ie malware that pretends to be an Antivirus when in reality he is a malware. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alert that there are more malwares in your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is Antivirus System Pro. It invites you to purchase a license to remove the malwares it shows you, do not, it's a scam, you need a license for a malware (ie Antivirus System Pro)? This so-called Antivirus tries to scam you.

To remove Antivirus System Pro:

• Click on the "Download" button, in the bottom
• Download it and unzip it on your desktop
• Launch the patch and then click "delete"

You have nothing else to do, the malware is deleted from your system.
After running the patch, your Internet Explorer’s homepage becomes search.net-studio.org, done deliberately to erase all traces of the malware, BHO(Browser Helper Object) and dll included. You can always restore this setting in Internet Explorer’s option.

Malwares' process

• sysguard.exe
• uninstall.exe
• Antivirussystempro.exe
• [RANDOM CHARACTERS].exe
• cfmbsysguard.exe
• drweb.exe
• login.exe
• nvsvc32.exe
• services.exe
• winlogon.exe

Dll registered by the malware

• iehelper.dll

Files and folders

• %ProgramFiles%\Antivirus System PRO\quarantine.vdb
• %ProgramFiles%\Antivirus System PRO\queue.vdb
• %ProgramFiles%\Antivirus System PRO\mbase.vdb
• %ProgramFiles%\Antivirus System PRO\conf.cfg
• %ProgramFiles%\Antivirus System PRO\uninstall.exe
• %ProgramFiles%\Antivirus System PRO\Antivirussystempro.exe
• %System%\system32\iehelper.dll
• %Windows%\sysguard.exe
• %Temp%\2457081384.exe
• %Temp%\calc.dll
• %UserProfile%\ntuser.dll
• %Programs%\Startup\scandisk.dll
• %System%\calc.dll
• %Temp%\cfmbsysguard.exe
• %Temp%\drweb.exe
• %Temp%\login.exe
• %Temp%\nvsvc32.exe
• %Temp%\services.exe
• %Temp%\winlogon.exe
• %Temp%\jisfije9fjoiee.tmp
• %Temp%\nsrbgxod.bak
• %Temp%\pskfo83wijf89uwuhal8.tmp
• %Temp%\tx2hjz.dll
• %Temp%\_A00F1C281F46.exe
• %Temp%\_A00F36D42.exe
• %Temp%\__c001BE8.dat
• %System%\__c00A8DC6.dat
• %System%\__c00C45A8.dat
• %System%\wbem\Performance\WmiApRpl_new.ini
• %Programs%\Startup\scandisk.lnk

Registry

• HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus System PRO
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus System PRO
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Antivirus System PRO”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad “ieModule”
• HKEY_CURRENT_USER\Software\AvScan
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “system tool”
• HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
• HKEY_CURRENT_USER\Software\AvScan
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
  
  • (Default) = "%Temp%\tx2hjz.dll"
  • ThreadingModel = "Apartment"
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  
  • (Default) = "%Temp%\tx2hjz.dll"
  • ThreadingModel = "Apartment"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  • calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
  
  • Asynchronous = 0x00000001
  • DllName = "%System%\__c00A8DC6.dat"
  • Impersonate = 0x00000000
  • Startup = "B"
  • Logon = "B"
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
  
  • DisableSR = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows
  
  • PopupMgr = "yes"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  
  • NoFolderOptions = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  
  • DisableRegistryTools = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  
  • calc = "rundll32.exe %UserProfile%\ntuser.dll,_IWMPEvents@0"
  • [RANDOM CHARACTERS] ="%Temp%\drweb.exe"
  • [RANDOM CHARACTERS].exe = "%Temp%\_A00F36D42.exe"
  • [RANDOM CHARACTERS] = "%Temp%\nvsvc32.exe"
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
  
  • JITDebug = 0x00000001