Comments on: Antivirus System Pro alert

By: Luciana

Luciana — Mon, 31 May 2010 12:27:00 +0000

Here's Antivirus System Pro removal guide. Open the link and scroll down till you see the title "Antivirus System PRO manual removal instructions". Then simply follow the steps given there.

By: Adrian

Adrian — Mon, 31 May 2010 10:44:32 +0000

Im having these same problems too and its driving me mental!!! Please can someone tell me step by step what to do??

THANKS HEAPS IF YOU CAN!!!

By: BA

BA — Tue, 04 May 2010 14:29:36 +0000

Great… it worked perfectly. Just had to fiddle with timings to get restore started before spyware kicked in…. Many thanks…

By: Tony

Tony — Mon, 03 May 2010 07:56:47 +0000

Hi, i’ve tried ’system restore’ in the safe mode, but the problem with this virus is still there and system restore wasn’t completed sucessfully. in normal mode, even if i try system restore, before the virus pops out, as soon as it does so, the system restore process cannot be completed. Yet the ‘antivirus system pro alert’ hasn’t been completely installed in my computer and it tries to download it when I log on without letting me do anything else. Shall I install it and then try to remove it? Any help would be very very much appreciated and needed! Thanks

By: Barbara

Barbara — Wed, 21 Apr 2010 01:05:22 +0000

You are wonderful!! Thanks so much this was driving us nuts! Many thanks!

By: Ali

Ali — Sat, 17 Apr 2010 19:16:23 +0000

hey i’ve recently had this problem on my computer however i was able to fix it through a system restore. but now the limewire program on my computer is unable to work. it says the media is damaged and wont allow me to run the program. i even recently tried uninstalling it n then reinstalling it however now it wont reinstall at all! this issue has been bothering me greatly for some time now and any advise would be a great help!
any sugestions?!?

By: SV

SV — Sat, 10 Apr 2010 01:19:27 +0000

Kaderu-senpai, your solution of system restore along with Paulo’s tip worked perfectly. Thanks very much!

By: ni

ni — Fri, 09 Apr 2010 21:13:49 +0000

Worked great. Had to do it in “safe mode” Thanks

By: Ian

Ian — Tue, 30 Mar 2010 19:07:00 +0000

did system restore in safe mode. I couldn’t find teh files that where mentioned do I still need to delete files and such.

By: ky

ky — Tue, 30 Mar 2010 14:49:32 +0000

OMG THANK YOU!!!!!!!!! my computer now works good thing i had another laptop to research this

By: cdl

cdl — Mon, 22 Mar 2010 23:33:00 +0000

I got rid of the annoying parts of this virus (pop ups ect.) but now I can’t connect to the internet… I tried going into internet options & adjusted my LAN settings but nothing. And BTW, system restore is what worked for me! I deleted some stuff from my registry too… Any ideas how I can get back online??

By: kaveen

kaveen — Wed, 17 Mar 2010 07:47:09 +0000

here is a another way to solve this problem try it if posible :

1)shut down your computer and turn on/or just click restart button
2)press f8 during rebooting
3)use arrows to highlight the phrase written “restore” safe mode
4)click yes
5)there will be no wallpapers for this safe mode and know you could operate your computer as usual..
5)try uninstalling the program know and delete all files including the downloads file.
6)click restore program and wait …………………
7)follow the steps shown in system restore click next and wait,,,,,,,,,,,,
8)okk!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

By: Johnny Horsecock

Johnny Horsecock — Sat, 06 Mar 2010 09:36:00 +0000

I got this fuckin’ virus last night and here’s what worked for me (at least so far, I have Windows Vista by the way–that should tell you how little I care about my computer, I just use it for the internet):

I’m not much of a computer nerd at all so of course I fucked up the system restore option at first–instead of selecting a previous restore date I clicked on create and it created a new one (which was my computer at the current moment, which obviously was no good, since it currently had this pain in the fuckin’ ass virus!) so after a couple of hours trying different shit and getting some ideas from this page and 1 or 2 others I stumbled my way to this solution, that hopefully lasts!

Restart your computer
as soon as it comes back on hit ctrl+alt+del to bring up the task manager
Under ‘Processes’ look for the .exe that looks like the virus–for me it was ‘pyyrsftav.exe’, click on it and hit ‘end process’-that will at least stop the annoying pop-ups
then while still in task manager right click the ‘pyyrsftav.exe’ to ‘open file location’-this is cool cause it tells you exactly where this cocksucking virus is on your computer-
that brings you to the folder containing this virus–right-click this folder and select ‘Rename’-rename the folder anything you want-I renamed it ‘fucku’-you can now delete the folder from your hard drive that contains this fucking virus, I even empty the fuckin’ recycling bin just in case that matters, which it probably don’t

that seems to be working for now, I posted this for any non-computer nerds who may be in the same boat I was, so excuse the non-technical language

By: Mystic7

Mystic7 — Sun, 28 Feb 2010 13:19:43 +0000

The system restore trick works (safe mode or not), however, I did this 2 days ago, fixed the problem, and then this morning it came back, this time with a new name (I forget what it is, I immediately did a system restore to get rid of it again).

Anyway, needless to say, as of now system restore seems to be only a temporary solution. I tried manual removal but as others have said, most of the files are not listed in the registry or in task manager. Seriously the guy who invented this should have his balls cut off. Why is it so difficult to find him?

By: 4RENZIXS

4RENZIXS — Tue, 23 Feb 2010 15:31:51 +0000

TO GET TO SAFE MODE YOU HAVE TO TURN YOUR COMPUTER OFF AND THEN TURN IT BACK ON WITH YOUR FINGER DEPRESSED ON THE F8 KEY ALL THE WHILE. DON’T LET UP ON THE F8 KEY, KEEP IT DEPRESSED BEFORE YOU PRESS THE ON BUTTON ON YOUR COMPUTER AND DURING BOOT UP. ONCE YOU REACH SAFE MODE YOU SHOULD BE ABLE TO SELECT SAFE MODE AND SYSTEM RESTORE. I HAD THIS RAPIST ASS VIRUS YESTERDAY !!!

By: Paolo

Paolo — Mon, 22 Feb 2010 15:22:32 +0000

Excellent….I knew I had to do a restore but couldn’t get to it on time. I made a shortcut to ’system restore’ restarted and whammo…got to it in time and now I’m anti virus pro FREE….thanks again

By: dk

dk — Tue, 16 Feb 2010 21:38:04 +0000

AD you are a genius!!! thankyou!!

By: Matt Baker

Matt Baker — Mon, 15 Feb 2010 04:01:13 +0000

Daughter got this terd from a website doing research for high school. I did the reboot and system restore after 2 hours of chasing my tail. Seems to be working.

By: norah

norah — Tue, 09 Feb 2010 22:49:52 +0000

lin said : “Thank you so much Kaderu, a foot of snow and I get this thing!”

Me too, you saved the day!
Blessings!

By: lin

lin — Fri, 05 Feb 2010 15:41:46 +0000

Thank you so much Kaderu, a foot of snow and I get this thing!! The re-boot and restore was perfect!!!

By: duece

duece — Thu, 04 Feb 2010 14:32:09 +0000

Props to Kaderu-senpai! Pretty simple fix. Rebooted system and was able to access system restore prior to the malware starting up. All is well. Thanks again Kaderu!

By: natalie

natalie — Fri, 22 Jan 2010 21:49:42 +0000

i love you Kaderu,my brother gave me his comp to fix as i have another laptop to look help up and here you are, worked a treat but had to be fast.it loaded virus just as i clicked restore and it started to restore and shut down,oh he owes me big time for fixing this,thanks yr a star

By: lilkunta

lilkunta — Thu, 21 Jan 2010 21:43:20 +0000

Luciana: Hello! I thought you had grew tired of us asking you questions.
The malware wont allow me to get to safe mode.
I hit F8 & choose safe mode but it does not load.
I am only able to get to debugging mode.

By: Luciana

Luciana — Thu, 21 Jan 2010 07:29:06 +0000

The error codes you get when trying to run security tools are displayed by the malware. It prevents you from running tools to prevent you from deleting the infection. However, you should be able to run the removal programs in a safe mode. This way you don’t need any assistance and you don’t have to pay to anyone.

By: lilkunta

lilkunta — Wed, 20 Jan 2010 20:54:09 +0000

Hi Stu. Thanks for this detailed explanantion. I told my friend this. She is weary of letting me do this. She says that I will infect her computer. Please what may I tell her to reassure her that I wont infect her computer? Thank You.

Everyday I try. I am was able to get the registry editor working by dowloading ‘resgitry fixer’ to a cd than loading it to my computer. But all the others things that I have tried ( malwarebytes, spyware dr, and others that Im unable to remember right now) do not work. I get various error codes. PLEASE . I do not have the $ to take it to a tech guy to fix. I did think that at first but they charge $150 for just the diagnostic (and i dont need this bc I know Im infected with malware) and then additional money 9 varying from $55-85 an hour) depending on how long it takes them to fix it. I am unable to afford that.

By: stu

stu — Tue, 19 Jan 2010 16:46:42 +0000

Here’s what works when all else fails:

–Remove Hard Drive from infected computer
–Obtain an adapter to enable plugging the drive into a different computers USB input. (THis will be a SATA or IDE to USB adapter. Google it, they are cheap. Or find a techie friend to help.)
–Plug the infected drive into other computer USB. It will show up in explorer as a separate drive letter. Scan the infected drive using Malware Antibytes (or other tool that you KNOW will remove this malware). It will be cured!
–While you are at it, copy/back up any important data files from the infected drive.

By: Yoli

Yoli — Sat, 09 Jan 2010 06:43:13 +0000

Thank you so much. This program has been kicking my ass for the last 4 hours. Luckily I had another laptop to research a solution. This is the only thing that’s worked. Great! I can breathe now!

By: stu

stu — Fri, 08 Jan 2010 04:30:27 +0000

OK, like Rockstar asked above, what do we do with the latest nasty variant. It will not start in safe mode. Period. You can NOT get to msconfig, or task manager, or regedit. Period. Perhaps removing drive and scanning on another PC is ONLY option??

By: lilkunta ( belinda )

lilkunta ( belinda ) — Tue, 29 Dec 2009 15:24:55 +0000

belinda:
Oh ok. Thanks for clarifying. I tried to do system restore but this malware has disabled it.
I think I need to d/l a malware removal to a cd, then put it in my computer. Hopefully that will work. Thannls.

By: Belinda

Belinda — Tue, 29 Dec 2009 10:06:42 +0000

That of Kaderu-senpai (27/11/09)– was able to get into system restore before the nasty virus started up and put in a previous date and reset computer – did the job, and all is well. Much relieved to have things working properly again.

By: lilkunta

lilkunta — Mon, 28 Dec 2009 20:40:27 +0000

belinda: Whose post is it that you followed and worked? Please share! Thanks.

By: Belinda

Belinda — Mon, 28 Dec 2009 01:28:57 +0000

After three hours of searching and trying this, that and all sorts of frustrating dead ends- you’re suggestion has been the only one that has worked! Many blessings upon you : )

By: lilkunta(AD)

lilkunta(AD) — Mon, 21 Dec 2009 20:24:42 +0000

AD: I uncheck ‘proxy’ and did checked ‘automatically detect settings’. Still nothing.
Everyone is using wireless internet, sigh. I need to find a modem to plug mu ethernet cord to and see if I may get online that way. I will let you know.

By: lilkunta(LUCIANA)

lilkunta(LUCIANA) — Mon, 21 Dec 2009 20:22:21 +0000

@ Luciana: USB is not being read. I have to wait & get help for cd method.
I still am unable to get to safe mode. The only 1 Im able to get to is
‘ Directory Services Mode Windows Domain Controllers ‘. From this mode still the regedit and system restore are disabled.

By: AD

AD — Sat, 19 Dec 2009 01:06:18 +0000

This is difficult to troubleshoot without being there. I can only suggest checking the box for “automatically detect settings,” and make sure the proxy box is cleared. I don’t know if the malware does anything to your wireless network settings.

By: lilkunta ( reply to AD)

lilkunta ( reply to AD) — Mon, 14 Dec 2009 15:27:00 +0000

I changed the settings by unchecking proxy. Still the internet is blocked.
Do I need to plug up to the modem with a ethernet cord in order to get online?

By: Andrea

Andrea — Sat, 12 Dec 2009 18:05:22 +0000

Kaderu-senpai, whoever you are, you are my saviour. THANK YOU, thank you, thank you.

By: lilkunta

lilkunta — Fri, 11 Dec 2009 19:06:01 +0000

@lucian: The malware has disabled the USB drive. I will try via cd. I will let you know.

By: Bri

Bri — Fri, 11 Dec 2009 15:56:18 +0000

Instructions are for Windows XP. Shutdown your computer, either via shutdown or press the power button for 4 seconds. Turn your computer back on and press F8 repeatedly. If Windows starts to load you missed it. Press power button for 4 seconds until computer shuts off again. Then turn on and press F8 repeatedly. Windows will prompt you…Start Windows in Safe Mode (at the top of the screen). Log in to your computer if prompted and do a system restore. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore. On the Welcome screen, click Restore my computer to an earlier time, and then click Next. Continue to follow the prompts. The computer will shut down automatically and reboot. On reboot, you’ll see the Restoration Complete page, and then click OK. Start windows normally and you will be virus free.

By: Luciana

Luciana — Fri, 11 Dec 2009 08:19:53 +0000

You can download anti-spyware on another computer and then copy the install file to your PC using USB drive or CD.

By: lilkunta

lilkunta — Thu, 10 Dec 2009 15:42:13 +0000

I have the exact same problem as LaLa.
So please how do we get rid of this malware?
We cant get online, we cant get to safemode; the malware has disabled the registry editor & system restore…. HELP!

By: LaLA

LaLA — Wed, 09 Dec 2009 15:24:58 +0000

OMG PLEASE i tried everthing from safe mode, regedit, task mang. ( i can’t find the name in Task mang. ) could it be under somethng else?

Also it won’t let me run the cd i just bught( Trend Micro ) I can’t get online … porn keeps poping up.

PS. System restore won’t open … this virus or what ever the hell it is won’t let me open the system restore.

Bankfox and win32 nuqul…. im very upset please help me?Thank you ….

By: Luciana

Luciana — Mon, 07 Dec 2009 08:18:02 +0000

Maybe it’s not Antivirus System Pro that you’ve got on your computer. It might be some other infection. We could help you with the manual removal if we knew the name of the malware.

By: rockstar

rockstar — Sun, 06 Dec 2009 16:16:04 +0000

a good friend of mine recently encountered a problem that will not allow him to start up in safe mode, search the internet, or run any anti- malware , spyware, of virus software. nor will it allow him to run the task manager to see what processes are running. could i have a couple of suggestions that will help me fix this problem. (side note) running a full restore is not a possibility there are too many files that are important to his work. i did not find any reference to antivirus system pro nor can i find any .exe files that should not be there. thanks for any help that is offered.

By: david T

david T — Sat, 05 Dec 2009 09:51:29 +0000

Seriously, simply turn off. Turn back on , instantly go to system restore , it starts to put up it’s warning messeges but not enough to stop the restore working, go back a couple of days and it’s fine !

Both a malware scan and virus scan show the systems clean.

God it was annoying though !!!!!

By: DK

DK — Thu, 03 Dec 2009 14:17:26 +0000

Thank you so much. You are so right. That worked perfectly. I am now anti virus PRO free. YAHOOOOOOO!!!!!!!!!

By: Peter

Peter — Wed, 02 Dec 2009 18:40:46 +0000

Thanks, AD:

After finding and deleting the “sysguard” files (see my post of 1 Dec), your reset of the LAN settings seems to have done the trick: I am back on the internet and appear to be AntiVirus System Pro-free!

One other thing: A free scan (via PC Tools) turned up two “sdra.exe” files on my system, which a quick Google shows are a Trojan. I don’t know if this came to me thanks to AntiVirus System Pro, but I hadn’t seen them before. Interestingly, neither Webroot Spy Sweeper nor MS File Search could find the sdra files that PC Tools discovered.

Then I discovered the freeware Super AntiSpyware: It did a super job of finding the sdra files (and about 30 cookies that no one else had spotted) and removing them.

After a day-and-a-half’s work, I think I am back to where I was before all this happened.

By: AD

AD — Wed, 02 Dec 2009 03:27:01 +0000

For everyone still having trouble accessing the internet: this shit program modifies your internet settings to use a proxy. You need to go into control panel, internet options, connections tab, LAN settings button, uncheck the proxy box and check the box for “automatically detect settings.” You should be back to normal from there.

The key to getting rid of the popups and everything is to search for the “*sysguard.exe” file and delete it. In my case, it was mxxqsysguard.exe.

Once you’re clear again, I recommend two preventative measures: (1) stop surfing porn. (2) create two different logins for your computer, even if you’re the only user, and make one of them a “limited” account. Use the limited account for your normal stuff, and use the regular (administrator) account when you need to install software, reconfigure stuff, and recover from attacks like this. Doing that made my life much easier when I got hit with this antivirus PRO bullshit because I was able to log out of my infected limited account and log into my “administrator” account. From there, I surfed the web (steering clear of porn sites) for a solution to my problem. No need for a second computer.

Also, for what it’s worth, I traced the source of mine to a wannabe social networking site, so porn sites aren’t the only places you can pick this up.

By: Rick

Rick — Tue, 01 Dec 2009 19:37:28 +0000

I just got Antivirus System Pro, just like this one. I just read the simple 5 minute removal method posted on Nov. 15, 2009 by Barry under the same title. I found it too late after I already wiped my system drive to install linux. Always store data on a second drive, and the system drive by itself.
All I see are people trying to remove this malware, but novbody is talking about the other threats about idenitity theft when people enter their information these hackers hope everyone will do. I entered fake info, to see if it would shut it off, but it didn’t work of course. Then what do I see about 7 hours later but an email from PayPal, with the same info I entered to Antivirus, stating the following to paypal.com, he wrote to them, and paypal couldn’t find the account he asked for:

Original Message Follows:
————————
Form Message
customer subject: nnnnnnn@netzero.com
customer message: Additional Information: ‘I have a new paypal account
nnnnnnnn@gmail.com. But I owe money on my old account.
nnnnnnnn@netzero.com my old address was ### sterling west Justice IL
##### How do I get in my old account? My new account is
nnnnnnnnn@gmail.com

NNNN NNNN’

This guy takes people’s old paypal accounts, and modifies them to funnel the money from his malware, and changes it enough not to get caught. If PayPal would cooperate with federal authorties and find this guy, and trace what his bank account is, we’ll finally catch him when he goes to withdraw our money.

This program managed to find my current paypal account too. Now I have to worry about if he’ll hijack my current paypal account, which I had to change to avoid.

By: Peter

Peter — Tue, 01 Dec 2009 17:26:35 +0000

I picked this up last night/early this morning on my desktop, visiting a site that I shouldn’t have been visiting in the first place (thank you again, karma!).

In my case the file turned out to be called “fjjwsysguard”. I found it with the help of the above poster who suggested the “sysguard” content of any likely file, and then was able to confirm it with the time and date that I acquired the file. I then searched for other files acquired around the same time. Deleted them both (yes, I only found two files).

Now, at least, AntivirusSystemPro doesn’t seem to load itself on startup, and I seem (so far) to be able to access and use the files and programs on my computer.

But I am so far unable to access the Internet (I’m using my laptop to send this).

Any ideas?