How to remove Antivirus

Tuesday, August 3rd, 2010 at 4:56 am
Home » Rogue Antispyware » Antivirus

Antivirus description

Antivirus a.k.a. AVT.exe is a yet another rogue program. Don’t let the name mislead you into purchasing Antivirus for computer protection!

The fake Antivirus program is easy to recognize because it is installed without user’s consent and it’s represented by avt.exe process on the Task Manager. If the program in the screen-shot above appears on your machine, delete it as soon as possible.

Antivirus fraud is difficult to ignore or escape. It brings enormous amount of pop-ups asking its victims to pay for using the program. The demand is kind of ironic because Antivirus prevents people from deleting it. The fake Antivirus may disable regular security programs and it may hijack web browser.

Here are some examples of the counterfeit Antivirus warnings:

Warning! Network Attack Detected!
Your computer is being attacked from a remote PC.
Attack from <ip address>
Process is trying to steal your passwords listed below. It is highly recommended to block this threat now.

Antivirus alert – Critical Threat Detected
Warning: Network attack detected
Network attach has been detected. Process is attempting to access your private data.
Unauthorized person tries to steal your passwords and private information. Click on the message to prevent identity theft.

User’s activity loggers detected!
It’s strongly recommended to remove detected threats right now!
You are using a trial version.
It is recommended to purchase a commercial version.

Danger!
Harmful viruses detected on your computer. This malicious software may harm your computer. Click on the message to ensure the protection of your computer.

Warning! Keylogger detected!
Keylogger activity detected on your PC!
PDM.Keylogger activity has been detected. Process is trying to redirect keyboard input. Your passwords and other private information are at risk. Please click the button below to block and remove this threat now.

Warning! Adware detected!
Adware Module detected on your PC!
Zlob.Porn.Ad adware has been detected. This adware module advertises websites with explicit content. Be advised of such content being possibly illegal. Please click the button below to locate and remove this threat now.

It is highly recommended to remove this threat from your PC.
You are using a trial version. It is recommended to purchase a commercial version.

Most of the viruses and worms on your PC because of visiting pornosites or warez/torrent sites.

DANGEROUS!
ANTIVIRUS DETECTED SOME HARMFUL PROGRAMS ON YOUR PC! THEY MAY CORRUPT YOUR INFORMATION OR SEND IT TO HACKERS.
PLEASE, OPTIMIZE YOUR PC. IT RUN ONLY 10%.

Antivirus is a Rogue Antispyware software

How to manually remove Antivirus

To remove Antivirus spyware you must block Antivirus sites, stop and remove processes, unregister DLL files, search and delete all other Antivirus files and registry utility. Follow the Antivirus detection and removal instructions below.

The most typical software removal method is to remove Antivirus by using "Add or Remove Programs" service. However there may be hidden Antivirus files, running processes and registries in your computer, so Antivirus may recreate all other files after reboot.

Antivirus manual removal instructions

Stop and remove Antivirus processes:
avt.exe
uninstall.exe
mswinsck.exe
wscsvc32.exe
wmsdk64_32.exe
spam001.exe
spam003.exe
troj000.exe Read more how to kill Antivirus processes

Locate and delete Antivirus registry entries:
HKEY_CURRENT_USER\Software\Malware Defense
HKEY_CURRENT_USER\Software\Paladin Antivirus
HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Antivirus"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "wmsdk64_32.exe" Read more how to delete Antivirus registry entries
Download RegistryBooster 2010 to scan errors caused by Antivirus

Search and unregister Antivirus DLL libraries:
avtext.dll
avthook.dll
fiosejgfse.dll Read more how to unregister Antivirus DLL files

Detect and delete other Antivirus files:
c:\Program Files\AnVi\
c:\Program Files\AnVi\about.ico
c:\Program Files\AnVi\activate.ico
c:\Program Files\AnVi\avt.db
c:\Program Files\AnVi\avt.exe
c:\Program Files\AnVi\avtext.dll
c:\Program Files\AnVi\avthook.dll
c:\Program Files\AnVi\buy.ico
c:\Program Files\AnVi\help.ico
c:\Program Files\AnVi\scan.ico
c:\Program Files\AnVi\settings.ico
c:\Program Files\AnVi\splash.mp3
c:\Program Files\AnVi\Uninstall.exe
c:\Program Files\AnVi\update.ico
c:\Program Files\AnVi\virus.mp3
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus.lnk
%UserProfile%\Desktop\Antivirus Support.lnk
%UserProfile%\Desktop\Antivirus.lnk
%UserProfile%\Desktop\nudetube.com.lnk
%UserProfile%\Desktop\pornotube.com.lnk
%UserProfile%\Desktop\spam001.exe
%UserProfile%\Desktop\spam003.exe
%UserProfile%\Desktop\troj000.exe
%UserProfile%\Desktop\youporn.com.lnk
%UserProfile%\Local Settings\Temp\wmsdk64_32.exe
%UserProfile%\Local Settings\Temp\wscsvc32.exe
%UserProfile%\Start Menu\Programs\AnVi\
%UserProfile%\Start Menu\Programs\AnVi\About.lnk
%UserProfile%\Start Menu\Programs\AnVi\Activate.lnk
%UserProfile%\Start Menu\Programs\AnVi\Antivirus Support.lnk
%UserProfile%\Start Menu\Programs\AnVi\Antivirus.lnk
%UserProfile%\Start Menu\Programs\AnVi\Buy.lnk
%UserProfile%\Start Menu\Programs\AnVi\Scan.lnk
%UserProfile%\Start Menu\Programs\AnVi\Settings.lnk
%UserProfile%\Start Menu\Programs\AnVi\Update.lnk

We strongly recommend you to use spyware remover to track Antivirus and automaticaly remove Antivirus processes, registries and files as well as other spyware threats.

Download does not start? Try a mirror download here

Tags: , ,

2 Responses to

Antivirus

Trackbacks

Leave a Reply

Download does not start? Try a mirror download here
«
»