Comments on: Antivirus System PRO

By: Luciana

Luciana — Fri, 20 Nov 2009 08:00:49 +0000

You can download security tools on another computer and then copy the install files to the infected computer using usb drive.

By: allie

allie — Fri, 20 Nov 2009 07:37:52 +0000

I can’t even go to boot menu, and my laptop won’t let me delete the system32. every time it says it’s going to it never does I’ve tried deleting it over 123454 times already, and I have no computer/laptop to download the anti virus on, Im only on my cellphone internet right now and I need this fixed soon, because I do my school work on my laptop. please help, thanks.

By: Luciana

Luciana — Wed, 18 Nov 2009 09:45:43 +0000

Thank you for pointing out unclear sections of the tutorial. The article explains all the aspects you need to know while dealing with registry entries. You may need to know how to add new values and how to export a key/value. While removing Antivirus System PRO and most of other malware you only need to know how to delete registry entries.

By: kris

kris — Tue, 17 Nov 2009 20:06:28 +0000

Hi Walker,

Follow your way to rename iehelper.dll to iehelperFAKE.dll. Restart my computer, and it create another iehelper.dll. iehelperFake.dll can be deleted, but the new iehelper.dll still there and cannot be deleted. My computer detect
to find

Treat: SpywareProtect2009
File: C:\windows\system32\iehelper.dll
Location: unknown Storage

Since antivirus system pro has blocked Symantec software which is installed in my NB. So I doubt the message is fake.

So still cannot delete iehelper. Drive my crazy. HELP!!

By: kris

kris — Tue, 17 Nov 2009 14:38:00 +0000

How to delete registry entries?
http://www.spywarevoid.com/how-to-delete-registry-entries

I followed all the instruction from the very fist part to all of them.
It did work to remove antivirus system pro from my computer. You cannot imagine how excited I was. ( To a person with few computer tech knowledge like me, I’m freaking out and reformat and reinstall os etc… is a big thing. I was planning to get a computer shop to reformat my NB……)

But when I reboot the computer, the antivirus system pro is back again. So sad…..

I don’t know why…….

So I’m wondering maybe some parts I did weren’t correct or …..

I’m bit of confused with the part – How to delete registry entries?
(http://www.spywarevoid.com/how-to-delete-registry-entries)

Could you help to clarify below questions:

step a : Open Registry Editor. (clear)

step b: Navigate to find the needed registry key and value (clear)

step c: Select the value to modify it. (not clear)
Q: “Enter the new value”  is it to enter “1”? When you click modify, the original value is 1. So is it to enter “1” again??

step d: Find the value using the steps above and delete it. (clear)

step e: You may need to add a new value or a new key to the Windows registry. (not clear)

Q1: From the screenshot, the file “Opened” is still there. Why? Isn’t it deleted as
Step e?

Q2: To create a new value, I choose option “New” and then choose “DWORD value” . Is this correct? The screenshot shows New – Key. Is it to choose “Key” instead of “DWORD value” ? But it seems to choose “DWORD value”?

If choose “DWROD value”, it appear in right hand side. If choose “Key” it will show in the left hand side as a new folder. So which one to choose?

Is it possible the person who writes this article can make it clearer? It’s a great help to the person like me (with poor computer knowledge)

Step f: You may need to export certain key or value from the registry. (not clear)

Q1: As Step e creating a new value, but here the screenshot doesn’t show any new value or a new key. Just wondering the Step e and Step f are the other way round???

Step g: You can import missing or new values and keys. (clear)

PLEASE HEP !!!!!

By: Barry

Barry — Sun, 15 Nov 2009 19:53:44 +0000

Here’s a 5 minute fix. Click the ASP taskbar icon(the shield) to open the ASP main window. Right click “Properties”. You should be able to highlight the full location of the program ’s *sysguard.exe file. It’s the location listed under “Address (URL)”. You may only see 2 lines of the address, so you’ll need to left click-hold and highlight the address so you can drag down to see the final, randomly named folder and file name (ending in sysguard.exe). Write down the file path, restart in safe mode, then find the folder and file using “My Computer” or “Windows Explorer”. Delete the file, then the folder, then the “windows\system32\iehelper.dll” file. Restart in normal mode, run Malwarebytes and it should be over.

By: Joel D

Joel D — Sun, 15 Nov 2009 10:51:05 +0000

thanks for the instructions, i am the pinicle of computer illiterate, and managed to catch this thing in half an hour and remove it really effectively with this info… THANKS A BUNCH!!!!

and my condolences to all, those popups are hella annoying

By: Matt Wilcox

Matt Wilcox — Wed, 11 Nov 2009 14:33:07 +0000

I’m on XP, and mine was in the folder – c:/documents and settings/USERNAME/Local Settings/Application data/cmcuxi/pxfssysguard.exe.

Note the last folder and the four letters before the name appear to be randomly generated ones, so your’s might be different.

By: Sal

Sal — Wed, 11 Nov 2009 03:11:42 +0000

Believe I found variant, under new file name and location, in vista config, in directory \User\ (your user name goes here) \ AppData \ local \ mjlyfv . File name looks like ktwasysguard.exe. IF you can get into the Task manager during boot up, then stop this process named something like ktwasysguard.exe.
Also found in registry, delete both if found:
1) under “HKEY_CURRENT_USER\Software\AvScan ” (entire section?)
2) under “HKEY_CURRENT_USER\Software\Microsoft\WIndows\CurrentVersion\Run ” a key called something like jbuhrrdg containing the directory and file name of C:\user\…\AppData\local\mjlyfv\ktwasysguard.exe

By: Kelly

Kelly — Wed, 11 Nov 2009 00:22:53 +0000

THANK YOU!!!

Just got hit tonight with the AntiVirus System Pro. Contacted McAfee, who we have Total Protection Software from. Apparently NOT. The tech lady gave me some worthless info about how viruses are popping up every hour, every minute. Yes, I got a wee bit testy and asked how they managed to fix this when it just popped up in the last hour since it wasn’t sent to my computer to block it out. (I know, I hang my head). Got on my email, lo and behold, she sent me a link to fix it created back in March 2009. So they’ve known about it that long..grr.

It didn’t work. Contacted chat support… they told me I was stuck unless I wanted to spend an unimagineable amount of money to have them remove it for me. Or contact Dell and have them do it.

I turned to you….. You saved my computer from a certain death by sledgehammer!

We downloaded the link for the fix to a jump drive and transferred it to the infected computer. Naturally I encountered a million errors, it certainly did NOT want me to install the fix. It went wonderfully, until the blue screen of death at the end. I admit I was scared. Then restarted, got some BIOS information, and sent it on to Microsoft. Who knows what they’ll do with it. Regardless, got past that, and have not seen a red box since!!

THANK YOU!!! THANK YOU!!! THANK YOU!!!

By: adrian

adrian — Tue, 10 Nov 2009 19:20:13 +0000

what were the process names & where was the auto install file???

By: Dave from Idaho

Dave from Idaho — Tue, 10 Nov 2009 09:43:33 +0000

I found the processes by watching the CPU performance as the pop-up did its thing. I deleted it, followed the above directions, found some of the files listed and it seems to have solved it HOPEFULLY I will restore before I re-boot.

By: Jamie w

Jamie w — Tue, 10 Nov 2009 02:30:38 +0000

I noticed that they had changed the begining of the process names found 3 that where runnning. ended them and stoppes in its tracks but when reboot its back think I founf the auto install file for it hidden in a windows file. there where 4.

By: Morgan

Morgan — Sun, 08 Nov 2009 15:20:12 +0000

Well, I wasn’t able to find either of the processes given above in the process list. Also all but one of the “other files” to be deleted weren’t there. In addition, it will not allow me to unregister iehelper.dll, but I was able to delete it.

By: Struggling with removal

Struggling with removal — Sun, 08 Nov 2009 06:47:05 +0000

Are you sure of this? Have you had direct experience with Windows Defender working successfully in removing Antivirus System Pro malware?? I’m running a Windows Defender full system scan right now and it’s been going for 2 hours…I’m hoping it will remove this malware from my computer!

By: Toku

Toku — Fri, 06 Nov 2009 17:39:03 +0000

Thanks, this site worked great. I used the manual instructions. Also don’t forget to disable the system restore when deleting these files, just don’t make a mistake either.

By: Walker

Walker — Wed, 04 Nov 2009 04:53:26 +0000

to delete ‘iehelper.dll’ rename to something like ‘iehelperFAKE.dll’ then restart your computer and you can now delete

By: Re'vyn

Re'vyn — Sun, 01 Nov 2009 23:28:32 +0000

I went to task manager-processes and mine weren’t listed as sysguard or antivirsus system pro mine were listed as xrxftplt.exe and jxkksysguard.exe and i couldn’t find any of the files listed anywhere. Is it because of the name of the file is different do i need to search areas under a different name than antivirus system pro?

By: scott

scott — Sat, 31 Oct 2009 04:14:09 +0000

I am a newbie to all this as well. Just got hit with this one. I am able to get into safe mode on the affected computer and I am running a resotre to a date a couple of weeks ago. Do I have anything else I have to do after the restore is done? I did download the spy doctor file but when I when out for updates everything crashed…thus the restore I am doing now.

By: adnan

adnan — Fri, 30 Oct 2009 03:15:55 +0000

Hi, I can’t follow any of the recommendations listed, because this evil software is prohibiting safe mode, blocking the viewing of hidden files, blocking add/remove programs, blocking regedit. I literrally cannot do anything.

Please help!

By: Hai

Hai — Thu, 29 Oct 2009 05:09:08 +0000

I find AVScan in different registry than the one listed in the instructions above (HKEY_CURRENT_USER\Software\AvScan). Should I delete aVScan on any different registry? I appreciate any help I can get.

Thanks

By: Luciana

Luciana — Wed, 28 Oct 2009 07:47:36 +0000

Since Windows Defender detects Antivirus System Pro malware, it should be able to delete it.

By: Silver

Silver — Wed, 28 Oct 2009 01:02:37 +0000

I’m very frustrated because I have payed for Spyware Doctor to remove “Antivirus System Pro” from my computer. The first time, it was very easy and I was astonished by it’s capacities.

However, not even a week later the very same virus came back! This time, it kept on uninstalling my Spyware Doctor and when I re-installed it, it wasn’t able to start scanning because it was stuck on the “Checking” Mode. After much struggle, I was finally able to remove it and I believed the worst was over, but I was so very wrong.

Today again, while doing my usual routine intelli-scan with Spyware Doctor, it suddenly closed on me. Shocked, I tried to re-open it, but it was in vain. My computer could not find the program anymore. Then, for the third time now, Antivirus System Pro is creating havoc in my computer and for me. Again, my Spyware Doctor is unable to scan because it is constantly stuck on the “Checking Mode”. I’m not sure what do do anymore…

Also, I cannot run Spyware Doctor on Safe Mode because last time I tried, it gave me a blue screen saying that the virus was interrupting it from continuing on safe mode.

Thank you for your time and patience.

By: Hai

Hai — Wed, 28 Oct 2009 00:25:23 +0000

I have manually searched unsuccessfully for all the registries, DLL’s and EXE. files. However, Window Defender reportec that it has quarantined Antivirus System Pro. I am now plan to perform “system restore” to see if that AVSP is gone. Am I on the right track?

By: Barb

Barb — Mon, 26 Oct 2009 15:01:07 +0000

This might work, but as I said above it won’t let me into safe mode, not even with networking. I tried that first of all.

By: Luciana

Luciana — Mon, 26 Oct 2009 07:53:58 +0000

Take a look above the comments section to the “Antivirus System PRO manual removal instructions”. There are the names of files and processes listed along with explanation how to delete them.

By: Walt

Walt — Mon, 26 Oct 2009 05:39:34 +0000

As someone stated above, go into safe mode with networking:

Spam F8 as the system boots to the hard drive but BEFORE windows begins to load, if you miss it, start over.

Select safemode with networking (this will allow you to access the internet and reference pages such as this one)

Enter your admin password and voila.

Now you wont have to kill any of the services, they wont be running, and I didnt find 2/3rds of the registry entries this suggests. Also, mine was installed in a BS directory, something like “C:\program files\ukakgkashgfkaskfa”

What I recommend doing is opening the registry with regedit and search for specific phrases, “BAD4551D” for example. Be sure you are deleting the right entry, deleting the wrong one can have catastrophic results.

Anyway, I’m actually writing this as I’m finishing up the walk through.

Best of luck and thanks for posting the resolution.

Walt R.
I run The Planet, You’re welcome.

By: Terrance

Terrance — Sun, 25 Oct 2009 03:08:57 +0000

Wow. I am in the exact same situation. I go to the task manager and I don’t see it. I access temporary files and delete those, but one refuses to go. I found the iehelper.dll and tried to delete it but it says it’s in use! I have tried other antispy ware but my computer resists it. I almost wish I could make a virus eating virus that I can infect my own computer with. ER! Make it stop!!!

By: Ashley

Ashley — Fri, 23 Oct 2009 17:38:32 +0000

HELP! I can’t download the antivirus system pro removal tool, and am not savvy enough to know which malware processes to delete.

By: barb

barb — Thu, 22 Oct 2009 23:56:41 +0000

How do you get rid of this in the registry when the virus won’t let you get to the registry. It says the administator does not allow use of the registry and I am the administrator. It also won’t let me into safe mode. And they must have changed the name again, because none of the names to find are found on my computer. I went in and compared one computer to another and stopped all services that were not listed on the machine without the virus. This is a nasty bug, worse than the swine flu!

By: Luciana

Luciana — Tue, 20 Oct 2009 13:54:05 +0000

Delete files and registry entries like it’s described on the tutorial above the comments section.

By: AMAR

AMAR — Tue, 20 Oct 2009 13:39:09 +0000

i have tried everything but nothing worked…
please help how to remove these disgusting pop ups manually

By: Don Rulf

Don Rulf — Tue, 13 Oct 2009 21:10:01 +0000

I found the offending process to be “trtvsysguard.exe”, in my case. I tripped it by looking at the applications window in task manager for the bogus “virus removal” application, then redirecting to the process window where the above process was highlighted. Renaming the offending process to “trtvsysguard.dud” halted the madness upon reboot and allowed me to search the internet for help, eventually ending up here.

Thanks!

By: Raymond

Raymond — Fri, 09 Oct 2009 15:41:35 +0000

I had the same problem this morning and it kept popping on me, I went to All Programs–> Control Panel–> Add Remove programs and clicked on the first program that popped up , dont remember the name but some thing that came at the top and off it went..

I also had a Norton 360 installed on my computer and it gave me a msg that it blocked it but never removed it.

Thanks

Ray

By: Jun

Jun — Fri, 02 Oct 2009 20:53:33 +0000

Control Panel, Add-Remove Program, look for Antivirus Pro and installed date on right.
Go to Accesories, system tool, system restore, restore my pc to earlier time, click date back when your pc still working good.

By: chad

chad — Sat, 26 Sep 2009 02:55:51 +0000

similar to ross (reply 17), i found a process called irafsysguard.exe instead, it showed up in the prefetch and most of the registry keys. i’m sure it was related to the problem because killing the process stopped the popups. in program files it was also inside a folder with a string of random letters starting with the letter y. now i’m wondering if the automatic removal tool would’ve even worked with these other filenames?? i’m going to use linux from now on

By: ross

ross — Thu, 24 Sep 2009 16:17:36 +0000

i found a process called aixqsysguard.exe

should i end it or is it needed?

By: debussy

debussy — Mon, 21 Sep 2009 05:23:48 +0000

look for *sysguard.exe to stop the process.
then search for the folder and delete the folder
delete anything else like the windows/prefetch content with similar prefix/suffix

By: milad

milad — Mon, 07 Sep 2009 17:03:59 +0000

Can any one recommend me a trustworthy site that he or she had success of removing this nasty “Anitvirus system pro”? I really appreciate that

By: Vlad

Vlad — Fri, 28 Aug 2009 13:04:27 +0000

the windows antivirus pro is not letting me go on any program even the remover tool, please help

By: Luciana

Luciana — Thu, 13 Aug 2009 06:17:07 +0000

Run the anti-spyware in a safe mode. Antivirus System Pro is able to block security tools in a normal mode in some cases.

By: kenda

kenda — Wed, 12 Aug 2009 18:22:31 +0000

i tried the spy doctor thing but it doesn’t really work. it says access is denied when i try to delete iehelper

By: Luciana

Luciana — Wed, 12 Aug 2009 06:46:40 +0000

It seems that you got some kind of trojan that re-installs the infection or some files of Antivirus System PRO are left after the removal. Have you tried running anti-spyware?

By: kenda

kenda — Tue, 11 Aug 2009 21:53:29 +0000

i got rid of it for a while but it came back after an hour?
i also can’t delete the iehelper.dll it just comes back. help please?

By: Partik

Partik — Tue, 28 Jul 2009 03:28:12 +0000

I tried the manual cleanup steps and they worked beautifully, except that the Antivirus System Pro people have added a twist.

qxdbsysguard.exe is another file you need to “stop process” in the task manager. It is also needs to be erased in two places on the hard drive: C:\program files\gtttmv and C:\windows\Prefetch. Otherwise things seem to be going well.

Thanks for your help!

By: David Walton

David Walton — Tue, 28 Jul 2009 01:08:33 +0000

They seem to have changed the names to protect themselves. For example, looking at my McAfee (and why didn’t IT catch this mess??) I see that the file spawning this whole mess is now called C:\ProgramFiles\fgilgi\ihfrsysguard.exe I deleted that and it has stopped popping up. But I can find none of the Registry entries cited in the article.

By: Luciana

Luciana — Fri, 24 Jul 2009 06:18:57 +0000

Download security tool on another computer and then copy the install file to the infected pc using a thumb drive. Run antispyware to deal with Antivirus System Pro; antivirus tools are meant to delete different kind of computer infections.

By: Paul

Paul — Thu, 23 Jul 2009 15:10:48 +0000

Hey, I can’t seem to get this to work at all.
1. Can’t use ‘Run’ to get to registry (or anywhere else)
2. Using Webroot Antivirus, but webroot wasn’t able to delete it at first and now doesn’t even see that the virus is there
3. When I try to run a program I have to run it as an administrator or it won’t work
4. I can’t run the software on this page because a black box will pop up and disapear when I click to have it finish the download
5. Nothing in task manager besides regular programs (etc.)
6. Arggh help me!!

By: Luciana

Luciana — Fri, 10 Jul 2009 06:01:22 +0000

It seems like the manual removal won’t work on your computer. Copy some antispyware install from another computer and run a scan. Let the security tools do the job for you.

By: diana

diana — Thu, 09 Jul 2009 19:35:04 +0000

im on another computer next to the one that is infected. well i’m able to get on the internet now, but when i click on a link, it sends me to some other link. i’ve tried finding all the processes and files and all else that have been listed. and nothing. now what??