FrEn

E-mail Print PDF

Free malware removal tool to remove Antivirus Live

Written by Administrator  |  Saturday, 05 December 2009 03:11
AddThis Social Bookmark Button

Antivirus Plus is a fake antivirus which installs itself on your system without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application, the file names but the rest is the same. Its purpose is to scare you by posting false scan results so that you spend money on buying a full version which by the way doesn't even exist. Do not purchase this bogus application. Remove Antivirus Plus as soon as possible from your system.
Beware of this scam.

To remove Antivirus Plus

  • Download and extract this free malware removal tool for Antivirus Plus
  • Launch
  • Click on the delete button

 

Antivirus Plus will be removed in 10s.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

  • sysguard.exe
  • uninstall.exe
  • AntivirusLive.exe
  • [RANDOM CHARACTERS].exe
  • RANDOM CHARACTERS]sysguard.exe (ex : cfmbsysguard.exe)
  • drweb.exe
  • login.exe
  • nvsvc32.exe
  • services.exe
  • winlogon.exe
  • iehelper.dll
  • %ProgramFiles%\Antivirus Live\quarantine.vdb
  • %ProgramFiles%\Antivirus Live\queue.vdb
  • %ProgramFiles%\Antivirus Live\mbase.vdb
  • %ProgramFiles%\Antivirus Live\conf.cfg
  • %ProgramFiles%\Antivirus Live\uninstall.exe
  • %ProgramFiles%\Antivirus Live\AntivirusLive.exe
  • %System%\system32\iehelper.dll
  • %Windows%\[random]sysguard.exe
  • %Temp%\2457081384.exe
  • %Temp%\calc.dll
  • %UserProfile%\ntuser.dll
  • %Programs%\Startup\scandisk.dll
  • %System%\calc.dll
  • %Temp%\cfmbsysguard.exe
  • %Temp%\drweb.exe
  • %Temp%\login.exe
  • %Temp%\nvsvc32.exe
  • %Temp%\services.exe
  • %Temp%\winlogon.exe
  • %Temp%\jisfije9fjoiee.tmp
  • %Temp%\nsrbgxod.bak
  • %Temp%\pskfo83wijf89uwuhal8.tmp
  • %Temp%\tx2hjz.dll
  • %Temp%\_A00F1C281F46.exe
  • %Temp%\_A00F36D42.exe
  • %Temp%\__c001BE8.dat
  • %System%\__c00A8DC6.dat
  • %System%\__c00C45A8.dat
  • %System%\wbem\Performance\WmiApRpl_new.ini
  • %Programs%\Startup\scandisk.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Live
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus Live
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Antivirus Live”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad “ieModule”
  • HKEY_CURRENT_USER\Software\AvScan
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “system tool”
  • HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
  • HKEY_CURRENT_USER\Software\AvScan
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
    • (Default) = "%Temp%\tx2hjz.dll"
    • ThreadingModel = "Apartment"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
    • (Default) = "%Temp%\tx2hjz.dll"
    • ThreadingModel = "Apartment"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
    • Asynchronous = 0x00000001
    • DllName = "%System%\__c00A8DC6.dat"
    • Impersonate = 0x00000000
    • Startup = "B"
    • Logon = "B"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
    • DisableSR = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows
    • PopupMgr = "yes"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • NoFolderOptions = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • DisableRegistryTools = 0x00000001
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • calc = "rundll32.exe %UserProfile%\ntuser.dll,_IWMPEvents@0"
    • [RANDOM CHARACTERS] ="%Temp%\drweb.exe"
    • [RANDOM CHARACTERS].exe = "%Temp%\_A00F36D42.exe"
    • [RANDOM CHARACTERS] = "%Temp%\nvsvc32.exe"
  • HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
    • JITDebug = 0x00000001

download


 

Comments  

 
0 #33 Julian 2010-08-14 14:56
Thank you so much!! "Security Suite" was driving me mad
Quote
 
 
0 #32 Administrator 2010-06-28 20:33
Quoting faarah:
hi im farah i have some problem to canputer i have some verus i dont know what is it can you help me plz ok thanks it caming on screen antimal doctor warning


Use the removal tool on that address : http://www.net-studio.org/eng/patch/patch/243-free-malware-removal-tool-to-remove-antimalware-doctor.html
Download
Extract
Run
Click on the delete button
Quote
 
 
0 #31 faarah 2010-06-28 18:58
hi im farah i have some problem to canputer i have some verus i dont know what is it can you help me plz ok thanks it caming on screen antimal doctor warning
Quote
 
 
0 #30 Administrator 2010-06-09 07:55
Click on Start => Run
Type regedit and press enter
Open the key : "HKLM\SOFTWARE\M icrosoft\Window s NT\CurrentVersi on" and remove the key "Image File Execution Options"

Restart your computer

Tell me if that worked (or not), it should!
Quote
 
 
0 #29 Helpplease 2010-06-08 22:08
So I used this patch on my main computer and restarted. When I restarted and tried to open internet explorer a popup window came up that wanted me to specify what program to use to run it. The same happened to other programs I tried to run. Then I tried opening up other programs and it said the file could not be found. Any suggestions or possible causes of this? Any help would be much apprieciated
Quote
 
 
0 #28 hoggy 2010-01-20 19:19
What's happen when you launch this patch.

Try to do it in safe mode if you can restart you computer in safe mode.
Quote
 
 
0 #27 Vicky 2010-01-20 17:50
No matter what i do this thing won't go away.. Help! please!?
Quote
 
 
0 #26 Joe 2010-01-09 04:41
You really use a proxy?
Reinstall your antivirus software.

If that doesn't work, create another windows user account and try to open Internet on it.
Quote
 
 
0 #25 Linda 2010-01-08 19:26
I installed mozilla and when i tried to connect, it said "The proxy server is refusing connections". I screwed something up somewhere. Help!!
Quote
 
 
0 #24 Joe 2010-01-08 19:14
Try FireFox to see. It's an Internet browser. I recommend it.

http://www.mozilla.com/en
Quote
 

Add comment


Security code
Refresh

Related articles
Latest posts
Free malware removal tool to remove Antivir Solution Pro
_WRITTEN_BY Administrator 15/07/2010

Antivir Solution Pro is another rogue Antispyware from the Antispyware Soft and Antivirus Suite, that tries to get money from users by prompting them to register and buy their Fake products. Some…Read more...

Free virus removal tool to remove RVHOST.exe
_WRITTEN_BY Administrator 17/06/2010
  • RVHOST.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application allows remote access to the compromised system.
  • Downloads…
Read more...
Free virus removal tool to remove WinDefender.exe
_WRITTEN_BY Administrator 17/06/2010
WinDefender.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application creates startup registry keys. Read more...
Free malware removal tool to get rid of Defense Center
_WRITTEN_BY Administrator 12/06/2010
Defense Center is another rogue Antispyware from the Digital Protection family, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your…Read more...
Free virus removal tool to remove Xss.exe
_WRITTEN_BY Administrator 10/06/2010

Xss.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application allows remote access to the compromised system.

Xss.exe downloads files…Read more...

.
Information | Contact

© All Rights Reserved. net-studio.org 2009