Free malware removal tool to remove the fake Antivir

Fake Antivir is not the real Antivir, it installs itself on your system without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application, the file names but the rest is the same. Its purpose is to scare you by posting false scan results so that you spend money on buying a full version which by the way doesn't even exist. Do not purchase this bogus application. Remove it as soon as possible from your system.
Beware of this scam.

To remove Fake Antivir

• Download and extract this free removal tool for the Fake Antivir
• Launch
• Click on the delete button

This Fake Antivir will be removed in 10s.

After running the patch, your homepage Internet Explorer becomes search.net-studio.org, done deliberately to erase all traces of malware, BHOs (Browser Helper Object) are also deleted. You can always restore this setting in Internet Explorer options.

Process of the malware

• Antivir.exe

Folder

• %ProgramFiles%\AV
• %ProgramFiles%\Common Files\Uninstall
• %ProgramFiles%\Common Files\Uninstall\AV
• %CommonStartMenu%\AV

Files

• %CommonStartMenu%\AV\Antivir.lnk
• %CommonStartMenu%\AV\Uninstall.lnk
• %UserProfile%\Desktop\Antivir.lnk
• %ProgramFiles%\AV\antivir.exe
• %ProgramFiles%\Common Files\Uninstall
• %ProgramFiles%\Common Files\Uninstall\AV
• %ProgramFiles%\Common Files\Uninstall\AV\Uninstall.lnk
• %System%\UpdateCheck.dll
• %ProgramFiles%\AV\antivir.exe
• %Temp%\antivir.exe
• %Temp%\UpdateCheck.dll

Registry

• HKEY_CURRENT_USER\Software\EVAACD
• HKEY_CURRENT_USER\Software\EVACD1
• HKEY_CLASSES_ROOT\CLSID\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "AV"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform "WinNT-EVI 25.11.2009"