free virus removal tool for Antivirus System Pro

Written by Administrator | Thursday, 29 October 2009 10:23

Antivirus System Pro is a rogue, ie malware that pretends to be an Antivirus when in reality he is a malware. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alert that there are more malwares in your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is Antivirus System Pro. It invites you to purchase a license to remove the malwares it shows you, do not, it's a scam, you need a license for a malware (ie Antivirus System Pro)? This so-called Antivirus tries to scam you.

To remove Antivirus System Pro:

Click on the "Download" button, in the bottom
Download it and unzip it on your desktop
Launch the patch and then click "delete"

You have nothing else to do, the malware is deleted from your system.
After running the patch, your Internet Explorer’s homepage becomes search.net-studio.org, done deliberately to erase all traces of the malware, BHO(Browser Helper Object) and dll included. You can always restore this setting in Internet Explorer’s option.

Malwares' process

sysguard.exe
uninstall.exe
Antivirussystempro.exe
[RANDOM CHARACTERS].exe
cfmbsysguard.exe
drweb.exe
login.exe
nvsvc32.exe
services.exe
winlogon.exe

Dll registered by the malware

iehelper.dll

Files and folders

%ProgramFiles%\Antivirus System PRO\quarantine.vdb
%ProgramFiles%\Antivirus System PRO\queue.vdb
%ProgramFiles%\Antivirus System PRO\mbase.vdb
%ProgramFiles%\Antivirus System PRO\conf.cfg
%ProgramFiles%\Antivirus System PRO\uninstall.exe
%ProgramFiles%\Antivirus System PRO\Antivirussystempro.exe
%System%\system32\iehelper.dll
%Windows%\sysguard.exe
%Temp%\2457081384.exe
%Temp%\calc.dll
%UserProfile%\ntuser.dll
%Programs%\Startup\scandisk.dll
%System%\calc.dll
%Temp%\cfmbsysguard.exe
%Temp%\drweb.exe
%Temp%\login.exe
%Temp%\nvsvc32.exe
%Temp%\services.exe
%Temp%\winlogon.exe
%Temp%\jisfije9fjoiee.tmp
%Temp%\nsrbgxod.bak
%Temp%\pskfo83wijf89uwuhal8.tmp
%Temp%\tx2hjz.dll
%Temp%\_A00F1C281F46.exe
%Temp%\_A00F36D42.exe
%Temp%\__c001BE8.dat
%System%\__c00A8DC6.dat
%System%\__c00C45A8.dat
%System%\wbem\Performance\WmiApRpl_new.ini
%Programs%\Startup\scandisk.lnk

Registry

HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus System PRO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus System PRO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Antivirus System PRO”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad “ieModule”
HKEY_CURRENT_USER\Software\AvScan
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “system tool”
HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
HKEY_CURRENT_USER\Software\AvScan
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_USER\Software\Microsoft\Windows Script
HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
- (Default) = "%Temp%\tx2hjz.dll"
- ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
- (Default) = "%Temp%\tx2hjz.dll"
- ThreadingModel = "Apartment"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
- Asynchronous = 0x00000001
- DllName = "%System%\__c00A8DC6.dat"
- Impersonate = 0x00000000
- Startup = "B"
- Logon = "B"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
- DisableSR = 0x00000001
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows
- PopupMgr = "yes"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- NoFolderOptions = 0x00000001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- DisableRegistryTools = 0x00000001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- calc = "rundll32.exe %UserProfile%\ntuser.dll,_IWMPEvents@0"
- [RANDOM CHARACTERS] ="%Temp%\drweb.exe"
- [RANDOM CHARACTERS].exe = "%Temp%\_A00F36D42.exe"
- [RANDOM CHARACTERS] = "%Temp%\nvsvc32.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
- JITDebug = 0x00000001

Comments

0 #13 Kathie 2009-12-07 06:30

Downloaded the programs above but the virus will not allow me to get to the box to delete the malware. I keep getting a box that says "Application cannot be executed. The file rundll32.exe is infected. Do you want to activate your antifirus software now?" HELP!

Quote

0 #12 Bruce 2009-11-29 20:17

I have downloaded the program, and when I tried to run, it was blocked. I then changed the file name to rundll32.exe, and it was also blocked. can you give me some additional help? Thank You

Quote

0 #11 Administrator 2009-11-29 03:03

If someone can send me an infected file or give me just a link or a website so I can create a video tutorial.
The links that I have no longer work.

also to check if there is another version of the malware.

Quote

0 #10 Administrator 2009-11-29 02:42

This malware evolves over time and we try to update the patch as and when.

Alternatively, you can remove this malware with Windows Optimum.

Step-by-step guide :
- Download Windows Optimum
- Run
If you cannot run it the change its name to rundll32.exe
- Click on the "Process" button
- Check all malicious processes,
- Click on the button "Stop process and delete file"
This action will stop the process and delete the exe file
When all that is finished, you can delete the other parameters calmly.

Good luck.

Quote

0 #9 Nikki 2009-11-29 02:30

This patch did NOTHING to stop the Antivirus Pro. It's a waste of precious time.

Quote

0 #8 Jedediah 2009-11-28 22:59

Quoting Administrator:

Quoting Tim:
This virus blocks any program that goes after it, so nethier the downloaded program or the dll will run

I purposely infect my machine with this malware and I removed it with this removal tool, it works. You just have to rename it into rundll32.exe.

Try and see.

Tried this several tme but it never worked. Malware blocking operation. Anything else?

Quote

-1 #7 Administrator 2009-11-28 13:56

Quoting Tim:

This virus blocks any program that goes after it, so nethier the downloaded program or the dll will run

I purposely infect my machine with this malware and I removed it with this removal tool, it works. You just have to rename it into rundll32.exe.

Try and see.

Quote

0 #6 Tim 2009-11-28 13:41

This virus blocks any program that goes after it, so nethier the downloaded program or the dll will run

Quote

0 #5 Administrator 2009-11-24 05:11

Quoting Will:

I've downloaded the file. Can't save to desktop and am not given alternative to unzip it. The virus keeps blocking any efforts beyond download. ow do I get around this and how do I unzip file? Thanks.

Try with this one www.net-studio.org/patch/asp/rundll32.exe

Quote

0 #4 Will 2009-11-23 20:11

I've downloaded the file. Can't save to desktop and am not given alternative to unzip it. The virus keeps blocking any efforts beyond download. ow do I get around this and how do I unzip file? Thanks.

Quote

Refresh comments list
RSS feed for comments to this post.

free virus removal tool for Antivirus System Pro

Comments

Add comment