Free malware removal tool to remove Security Master AV

Written by Administrator | Saturday, 05 June 2010 18:14

Security Master AV is a rogue Antispyware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. Security Master AV conducts a fake scan of your system; you are warned by a fake alarm that there are more malwares on your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is Security Master AV. It invites you to purchase a license to remove malware, do not, it's a scam, you need a license for a malware? This so-called Antivirus tries to scam you. Uninstall Security Master AV immediately from your system.

Security Master AV

To remove Security Master AV (Uninstall Security Master AV)

Download this free removal tool for Security Master AV
Extract it
Launch
Click on the delete button

Security Master AV will be removed from your system in 10s. Restart your computer when it’s finished.

Processes :

SM8d7c.exe
ANTIGEN.exe
std.exe
SM345d.exe

Files :

%CommonAppData%\8d7ca11\25.mof
%CommonAppData%\8d7ca11\SM8d7c.exe
%CommonAppData%\8d7ca11\SMAV.ico
%CommonAppData%\8d7ca11\SMAVSys\vd952342.bd
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk
%AppData%\Security Master AV\cookies.sqlite
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk
%Desktop%\Security Master AV.lnk
%UserProfile%\Recent\ANTIGEN.drv
%UserProfile%\Recent\ANTIGEN.exe
%UserProfile%\Recent\cid.dll
%UserProfile%\Recent\CLSV.drv
%UserProfile%\Recent\DBOLE.sys
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\ddv.sys
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\FS.drv
%UserProfile%\Recent\gid.drv
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\PE.sys
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\std.exe
%UserProfile%\Recent\tjd.drv
%UserProfile%\Recent\tjd.sys
%UserProfile%\Recent\runddlkey.dll
%StartMenu%\Security Master AV.lnk
%StartMenu%\Programs\Security Master AV.lnk
%CommonAppData%\345d567\16.mof
%CommonAppData%\345d567\mozcrt19.dll
%CommonAppData%\345d567\SM345d.exe
%CommonAppData%\345d567\SMAV.ico
%CommonAppData%\345d567\sqlite3.dll
%CommonAppData%\345d567\Quarantine Items\
%CommonAppData%\345d567\SMAVSys\
%CommonAppData%\345d567\SMAVSys\vd952342.bd
%CommonAppData%\SMNPCTCAV\SMMPIBBZGHAV.cfg
%CommonAppData%\345d567
%CommonAppData%\SMNPCTCAV

Registry

HKEY_CURRENT_USER\Software\3
HKEY_CLASSES_ROOT\SMAVSys.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Security Master AV”
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\SM345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"