FrEn

E-mail Print

Free malware removal tool to remove Sysinternals Antivirus
Written by Administrator  |  Saturday, 05 June 2010 08:33
AddThis Social Bookmark Button
Sysinternals Antivirus is a another rogue Antispyware, it's a malware that pretends to be an Antivirus. Sysinternals Antivirus conducts a fake scan of your system; you are warned by a fake alarm that there are more malwares on your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is Sysinternals Antivirus. Sysinternals Antivirus invites you to purchase a license to remove malware, do not, it's a scam, you need a license for a malware? This so-called Antivirus tries to scam you. Uninstall Sysinternals Antivirus immediately from your system.

Sysinternals Antivirus

To remove Sysinternals Antivirus (Uninstall Sysinternals Antivirus)

  • Download this free removal tool for Sysinternals Antivirus
  • Extract it
  • Launch
  • Click on the delete button

Sysinternals Antivirus will be removed from your system in 10s. Restart your computer when it’s finished.

Processes :

  • alggui.exe
  • Sysinternals Antivirus.exe
  • svchost.exe (as a service)

Files :

  • %DesktopDir%\Sysinternals Antivirus.lnk
  • %Temp%\win1.tmp
  • %Temp%\win4.tmp
  • %Windir%\Temp\win2.tmp
  • %Windir%\Temp\win3.tmp
  • %Programs%\Sysinternals Antivirus\Sysinternals Antivirus.lnk
  • %ProgramFiles%\adc_w32.dll
  • %ProgramFiles%\alggui.exe
  • %ProgramFiles%\skynet.dat
  • %ProgramFiles%\svchost.exe
  • %ProgramFiles%\Sysinternals Antivirus\Sysinternals Antivirus.exe
  • %ProgramFiles%\wp3.dat
  • %ProgramFiles%\wp4.dat
  • C:\Sysinternals Antivirus\Sysinternals Antivirus.lnk
  • C:\Sysinternals Antivirus.lnk
  • %Programs%\Sysinternals Antivirus
  • %ProgramFiles%\Sysinternals Antivirus
  • C:\Sysinternals Antivirus

Registry

Registry keys created
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD\0000
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD\0000\Control
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd\Security
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd\Enum
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD\0000
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD\0000\Control
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\Security
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\Enum
  • HKEY_USERS\.DEFAULT\Software\Sysinternals Antivirus
  • HKEY_USERS\.DEFAULT\Software\Sysinternals Antivirus\Sysinternals Antivirus
  • HKEY_USERS\.DEFAULT\Software\Sysinternals Antivirus\Sysinternals Antivirus\Registration
  • HKEY_USERS\.DEFAULT\Software\Sysinternals Antivirus\Sysinternals Antivirus\setdata
  • HKEY_CURRENT_USER\Software\Sysinternals Antivirus
  • HKEY_CURRENT_USER\Software\Sysinternals Antivirus\Sysinternals Antivirus
  • HKEY_CURRENT_USER\Software\Sysinternals Antivirus\Sysinternals Antivirus\Registration
  • HKEY_CURRENT_USER\Software\Sysinternals Antivirus\Sysinternals Antivirus\setdatais1

Registry values created

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}\InprocServer32]
    • (Default) = "%ProgramFiles%\adc_w32.dll"
    • ThreadingModel = "Apartment"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}]
    • (Default) = "ADC PlugIn"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD\0000\Control]
    • *NewlyCreated* = 0x00000000
    • ActiveService = "AdbUpd"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD\0000]
    • Service = "AdbUpd"
    • Legacy = 0x00000001
    • ConfigFlags = 0x00000000
    • Class = "LegacyDriver"
    • ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
    • DeviceDesc = "Adobe Update Service"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ADBUPD]
    • NextInstance = 0x00000001
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd\Enum]
    • 0 = "Root\LEGACY_ADBUPD\0000"
    • Count = 0x00000001
    • NextInstance = 0x00000001
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd\Security]
    • Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 1200 00 00 00 00 18 00 FF 01 0F 0
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdbUpd]
    • Type = 0x00000010
    • Start = 0x00000002
    • ErrorControl = 0x00000001
    • ImagePath = "%ProgramFiles%\svchost.exe"
    • DisplayName = "Adobe Update Service"
    • ObjectName = "LocalSystem"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD\0000\Control]
    • *NewlyCreated* = 0x00000000
    • ActiveService = "AdbUpd"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD\0000]
    • Service = "AdbUpd"
    • Legacy = 0x00000001
    • ConfigFlags = 0x00000000
    • Class = "LegacyDriver"
    • ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
    • DeviceDesc = "Adobe Update Service"
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD]
    • NextInstance = 0x00000001
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\Enum]
    • 0 = "Root\LEGACY_ADBUPD\0000"
    • Count = 0x00000001
    • NextInstance = 0x00000001
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\Security]
    • Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd]
    • Type = 0x00000010
    • Start = 0x00000002
    • ErrorControl = 0x00000001
    • ImagePath = "%ProgramFiles%\svchost.exe"
    • DisplayName = "Adobe Update Service"
    • ObjectName = "LocalSystem"
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    • ProxyEnable = 0x00000000
  • [HKEY_USERS\.DEFAULT\Software\Sysinternals Antivirus\Sysinternals Antivirus\setdata]
    • scantime = "3.6.2010 6:10:26"
    • scncnt = 0x00000002
  • [HKEY_CURRENT_USER\Software\Sysinternals Antivirus\Sysinternals Antivirus\setdata]
    • scantime = "3.6.2010 6:10:57"
    • scncnt = 0x00000002

Registry keys modified

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
    • (Default) =
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
    • (Default) =
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
    • (Default) =
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
    • Cookies =
    • Programs =
    • History =

Download

 
 

Add comment


Security code
Refresh

Related articles
Latest posts

  • Free malware removal tool for Guard Online

    Written by %s admin 10/10/2011
    Guard Online is a another rogue Antispyware from the OpenCloud and AV Guard Online familly, it's a malware that pretends to be an Antivirus. Guard Online conducts a fake scan of your system; you are…
    Read more...

  • Free malware removal tool to remove AV Guard Online

    Written by %s admin 05/10/2011
    AV Guard Online is a another rogue Antispyware from the OpenCloud familly, it's a malware that pretends to be an Antivirus. AV Guard Online conducts a fake scan of your system; you are warned by a…
    Read more...

  • Free removal tool to remove Security Guard 2012

    Written by %s admin 05/10/2011
    Security Guard 2012 is a another rogue Antispyware from the OpenCloud familly, it's a malware that pretends to be an Antivirus. Security Guard 2012 conducts a fake scan of your system; you are warned…
    Read more...

  • Free removal tool for Advanced PC Shield 2012

    Written by %s admin 01/10/2011
    Advanced PC Shield 2012 is a another rogue Antispyware, it's a malware that pretends to be an Antivirus. Advanced PC Shield 2012 conducts a fake scan of your system; you are warned by a fake alarm…
    Read more...

  • Security Sphere 2012 Free Removal Tool

    Written by %s admin 01/10/2011
    Security Sphere 2012 is another spyware from the Security Tool family. Security Sphere 2012 is not a legit program; it's a fake, a counterfeit. Security Sphere 2012 claims to fix your system, but…
    Read more...
.
Information | Contact

© All Rights Reserved. net-studio.org 2009