Free malware removal tool to remove Antivirus Live

Antivirus Plus is a fake antivirus which installs itself on your system without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application, the file names but the rest is the same. Its purpose is to scare you by posting false scan results so that you spend money on buying a full version which by the way doesn't even exist. Do not purchase this bogus application. Remove Antivirus Plus as soon as possible from your system.
Beware of this scam.

To remove Antivirus Plus

• Download and extract this free malware removal tool for Antivirus Plus
• Launch
• Click on the delete button

Antivirus Plus will be removed in 10s.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Malwares' process

• sysguard.exe
• uninstall.exe
• AntivirusLive.exe
• [RANDOM CHARACTERS].exe
• RANDOM CHARACTERS]sysguard.exe (ex : cfmbsysguard.exe)
• drweb.exe
• login.exe
• nvsvc32.exe
• services.exe
• winlogon.exe

Dll registered by the malware

• iehelper.dll

Files and folders

• %ProgramFiles%\Antivirus Live\quarantine.vdb
• %ProgramFiles%\Antivirus Live\queue.vdb
• %ProgramFiles%\Antivirus Live\mbase.vdb
• %ProgramFiles%\Antivirus Live\conf.cfg
• %ProgramFiles%\Antivirus Live\uninstall.exe
• %ProgramFiles%\Antivirus Live\AntivirusLive.exe
• %System%\system32\iehelper.dll
• %Windows%\[random]sysguard.exe
• %Temp%\2457081384.exe
• %Temp%\calc.dll
• %UserProfile%\ntuser.dll
• %Programs%\Startup\scandisk.dll
• %System%\calc.dll
• %Temp%\cfmbsysguard.exe
• %Temp%\drweb.exe
• %Temp%\login.exe
• %Temp%\nvsvc32.exe
• %Temp%\services.exe
• %Temp%\winlogon.exe
• %Temp%\jisfije9fjoiee.tmp
• %Temp%\nsrbgxod.bak
• %Temp%\pskfo83wijf89uwuhal8.tmp
• %Temp%\tx2hjz.dll
• %Temp%\_A00F1C281F46.exe
• %Temp%\_A00F36D42.exe
• %Temp%\__c001BE8.dat
• %System%\__c00A8DC6.dat
• %System%\__c00C45A8.dat
• %System%\wbem\Performance\WmiApRpl_new.ini
• %Programs%\Startup\scandisk.lnk

Registry

• HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Live
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus Live
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Antivirus Live”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad “ieModule”
• HKEY_CURRENT_USER\Software\AvScan
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “system tool”
• HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
• HKEY_CURRENT_USER\Software\AvScan
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}\InProcServer32
  
  • (Default) = "%Temp%\tx2hjz.dll"
  • ThreadingModel = "Apartment"
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B45A4B16-23F2-41AD-F4E4-00AAC39C0004}
  
  • (Default) = "%Temp%\tx2hjz.dll"
  • ThreadingModel = "Apartment"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  • calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00A8DC6
  
  • Asynchronous = 0x00000001
  • DllName = "%System%\__c00A8DC6.dat"
  • Impersonate = 0x00000000
  • Startup = "B"
  • Logon = "B"
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
  
  • DisableSR = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows
  
  • PopupMgr = "yes"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  
  • NoFolderOptions = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  
  • DisableRegistryTools = 0x00000001
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  
  • calc = "rundll32.exe %UserProfile%\ntuser.dll,_IWMPEvents@0"
  • [RANDOM CHARACTERS] ="%Temp%\drweb.exe"
  • [RANDOM CHARACTERS].exe = "%Temp%\_A00F36D42.exe"
  • [RANDOM CHARACTERS] = "%Temp%\nvsvc32.exe"
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
  
  • JITDebug = 0x00000001