free patch to remove the malware Alpha Antivirus

Written by Administrator | Monday, 26 October 2009 19:33

Alpha Antivirus is a malware that pretends to be an Antivirus whereas in reality it is a malware that tries to fool its victims by warning with a false alarm that there is malware in your system. This is true elsewhere, there is actually a malware in your system, but the malware is not what it shows you, it is itself the malware. Remove it as soon as possible from your system.
Never trust a program you have not installed.

Afterwards, when it hits your system, the malware prompts you to buy a full version because this one is a trial version, which is not even able to remove nicks malware from your system. Never trust this type of program.

The details of this malware are shown below.
To remove Alpha Antivirus:

Click on the "Download" button, in the bottom
Download it and unzip it on your desktop
Launch the patch and then click "delete"

You have nothing else to do, the malware is deleted from your system.
After running the patch, your Internet Explorer’s homepage becomes search.net-studio.org, done deliberately to erase all traces of the malware. You can always restore this setting in Internet Explorer’s option.

Process

AlphaAV.exe
NetFilter.exe
AlphaAntivirus.exe

Files and folders

<CommonAppData>\Alpha Antivirus
<Start Menu>\Programs\Alpha Antivirus
<Start Menu>\AlphaAV
<CommonStartMenu>\AlphaAV\Alpha Antivirus.lnk
<CommonStartMenu>\AlphaAV\Uninstall.lnk
<Desktop>\Alpha Antivirus.lnk
<ProgramFiles>\Common Files\Uninstall\AlphaAV
<ProgramFiles>\Common Files\Uninstall\AlphaAV\Uninstall.lnk
<ProgramFiles>\AlphaAV\AlphaAV.exe
<ProgramFiles>\AlphaAV\NetFilter.exe
<ProgramFiles>\AlphaAV\AlphaAntivirus.exe
<ProgramFiles>\Alpha Antivirus
<System>\msnaoladdon.dll

dll to unregister

msnaoladdon.dll
ndisapi.dll

Registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Alpha Antivirus = <ProgramFiles>\AlphaAV\AlphaAV.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- AlphaAV = <ProgramFiles>\AlphaAV\AlphaAV.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- Alpha Antivirus = <ProgramFiles>\AlphaAV\AlphaAV.exe
HKEY_CURRENT_USER\Software\Alpha Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Alpha Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alpha Antivirus
HKEY_CLASSES_ROOT\CLSID\{A77D3539-581D-450C-9E44-A84C415A6172}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A77D3539-581D-450C-9E44-A84C415A6172}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post
- Platform = WinNT-PAI 05.10.2009