FrEn

E-mail Print PDF

Free malware removal tool to remove Antivirus Live

Written by Administrator  |  Saturday, 05 December 2009 03:11
AddThis Social Bookmark Button

Antivirus Plus is a fake antivirus which installs itself on your system without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application, the file names but the rest is the same. Its purpose is to scare you by posting false scan results so that you spend money on buying a full version which by the way doesn't even exist. Do not purchase this bogus application. Remove Antivirus Plus as soon as possible from your system.
Beware of this scam.

To remove Antivirus Plus

  • Download and extract this free malware removal tool for Antivirus Plus
  • Launch
  • Click on the delete button

 

Antivirus Plus will be removed in 10s.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

  • sysguard.exe
  • uninstall.exe
  • AntivirusLive.exe
  • [RANDOM CHARACTERS].exe
  • RANDOM CHARACTERS]sysguard.exe (ex : cfmbsysguard.exe)
  • drweb.exe
  • login.exe
  • nvsvc32.exe
  • services.exe
  • winlogon.exe
  • iehelper.dll
  • %ProgramFiles%\Antivirus Live\quarantine.vdb
  • %ProgramFiles%\Antivirus Live\queue.vdb
  • %ProgramFiles%\Antivirus Live\mbase.vdb
  • %ProgramFiles%\Antivirus Live\conf.cfg
  • %ProgramFiles%\Antivirus Live\uninstall.exe
  • %ProgramFiles%\Antivirus Live\AntivirusLive.exe
  • %System%\system32\iehelper.dll
  • %Windows%\[random]sysguard.exe
  • %Temp%\2457081384.exe
  • %Temp%\calc.dll
  • %UserProfile%\ntuser.dll
  • %Programs%\Startup\scandisk.dll
  • %System%\calc.dll
  • %Temp%\cfmbsysguard.exe
  • %Temp%\drweb.exe
  • %Temp%\login.exe
  • %Temp%\nvsvc32.exe
  • %Temp%\services.exe
  • %Temp%\winlogon.exe
  • %Temp%\jisfije9fjoiee.tmp
  • %Temp%\nsrbgxod.bak
  • %Temp%\pskfo83wijf89uwuhal8.tmp
  • %Temp%\tx2hjz.dll
  • %Temp%\_A00F1C281F46.exe
  • %Temp%\_A00F36D42.exe
  • %Temp%\__c001BE8.dat
  • %System%\__c00A8DC6.dat
  • %System%\__c00C45A8.dat
  • %System%\wbem\Performance\WmiApRpl_new.ini
  • %Programs%\Startup\scandisk.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Live
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus Live
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Antivirus Live”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad “ieModule”
  • HKEY_CURRENT_USER\Software\AvScan
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “system tool”
  • HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
  • HKEY_CURRENT_USER\Software\AvScan
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
    • (Default) = "%Temp%\tx2hjz.dll"
    • ThreadingModel = "Apartment"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
    • (Default) = "%Temp%\tx2hjz.dll"
    • ThreadingModel = "Apartment"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
    • Asynchronous = 0x00000001
    • DllName = "%System%\__c00A8DC6.dat"
    • Impersonate = 0x00000000
    • Startup = "B"
    • Logon = "B"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
    • DisableSR = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows
    • PopupMgr = "yes"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • NoFolderOptions = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • DisableRegistryTools = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • calc = "rundll32.exe %UserProfile%\ntuser.dll,_IWMPEvents@0"
    • [RANDOM CHARACTERS] ="%Temp%\drweb.exe"
    • [RANDOM CHARACTERS].exe = "%Temp%\_A00F36D42.exe"
    • [RANDOM CHARACTERS] = "%Temp%\nvsvc32.exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
    • JITDebug = 0x00000001

download


 

Comments  

 
0 #28 hoggy 2010-01-20 19:19
What's happen when you launch this patch.

Try to do it in safe mode if you can restart you computer in safe mode.
Quote
 
 
0 #27 Vicky 2010-01-20 17:50
No matter what i do this thing won't go away.. Help! please!?
Quote
 
 
0 #26 Joe 2010-01-09 04:41
You really use a proxy?
Reinstall your antivirus software.

If that doesn't work, create another windows user account and try to open Internet on it.
Quote
 
 
0 #25 Linda 2010-01-08 19:26
I installed mozilla and when i tried to connect, it said "The proxy server is refusing connections". I screwed something up somewhere. Help!!
Quote
 
 
0 #24 Joe 2010-01-08 19:14
Try FireFox to see. It's an Internet browser. I recommend it.

http://www.mozilla.com/en
Quote
 
 
0 #23 Linda 2010-01-08 18:52
it states that i am not connected to the internet. when i try to diagnose, it states:
"Windows cannot connect to the internet using HTTP, HTTPS, or FTP. This is probably caused by firewall settings on this computer.
Check the firewall settings for the HTTP port (80), HTTPS port (443), and FTP port (21).

Sorry not to computer savvy, so any help would be greatly appreciated. Thanks!!
Quote
 
 
0 #22 Joe 2010-01-08 18:28
What's happen when you launch IE?

Alternatively, try FireFox

Download it here http://www.mozilla.com/en
Quote
 
 
0 #21 Linda 2010-01-08 18:18
Ok i got the fix done in safe mode, but when i went back to regular mode, i can't open internet explorer. any ideas?
Quote
 
 
+1 #20 Carl 2010-01-08 15:07
nice one mate, that worked!!
Quote
 
 
0 #19 Administrator 2010-01-07 22:32
Quoting Carl:
i just managed to get the patch up by restarting my pc and before anything comes up clicking to open the fix. however, the patch will only let me click on the "how to boot in safe mode" option and not the delete or close options


Try with this one
http://www.net-studio.org/patch/Antivirus_Live_Fix2.zip

You don't have to click on the delete button with this one.
Launch and wait for a confirmation then restart your computer.
Quote
 

Add comment


Security code
Refresh

Related articles
Latest posts
Free malware removal tool to remove Total Vista Security
_WRITTEN_BY Administrator 16/03/2010
Total Vista Security is a rogue antispyware that may reprensent security risk for your system, it's a malware that pretends to be an Antivirus. Total Vista Security conducts a fake scan of your…Read more...
Free malware removal tool to remove Virus Protector
_WRITTEN_BY Administrator 15/03/2010

Virus Protector is a rogue Antispyware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that there are…Read more...

Free malware removal tool to remove Dr. Guard
_WRITTEN_BY Administrator 01/03/2010
Dr. Guard is a rogue Antispyware from the Paladin Antivirus Family, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are…Read more...
Free malware removal tool to remove Paladin Antivirus
_WRITTEN_BY Administrator 27/02/2010
Paladin Antivirus is a rogue Antispyware, a scareware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a…Read more...
Free malware removal tool to remove PC Defender
_WRITTEN_BY Administrator 24/02/2010
PC Defender is a rogue Antispyware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that…Read more...
.
Information | Contact

© All Rights Reserved. net-studio.org 2009