Comments on: Antivirus System PRO

By: Remove Infiltration Alert, Antivirus Suite Infiltration Alert removal

Remove Infiltration Alert, Antivirus Suite Infiltration Alert removal — Fri, 02 Apr 2010 10:49:41 +0000

[...] Win32/Nuqel.E may also be reported by other fraudulent antivirus tools as well. It usually appears on counterfeit reports displayed by Spyware Protect 2009 and Antivirus System Pro. [...]

By: Luciana

Luciana — Wed, 25 Nov 2009 05:22:45 +0000

Follow the manual removal guide in a safe mode.

By: bob

bob — Tue, 24 Nov 2009 20:22:58 +0000

it wont let me do manual uninstall saying that the hosts file is infected, which it isnt. wont open task manager, AVG, or my d drive. and my computer nerd friend is being an ass and not answering the phone. wat do i do?

By: tj

tj — Tue, 24 Nov 2009 07:24:37 +0000

i found voygsysguard.exe and deleted it from the processes and the pop-ups stopped immediately. did a search under sysguard and it came up again with a windows prefetch which i also deleted. seems all good.

By: Armando

Armando — Tue, 24 Nov 2009 00:34:13 +0000

This did it!

Thanks so much, this thing was nasty.

I would advice to every body to do this as well as follow the advice of # 36

Good luck

By: Brian

Brian — Mon, 23 Nov 2009 19:25:06 +0000

If you go down to

Barry’s sugestion located towards the bottom

date of Nov. 15th 2009.

That is the quick and easy, down and dirty fix…

Thank you Barry

By: Brian

Brian — Mon, 23 Nov 2009 18:10:29 +0000

One more thing… This site is ROCKS. I have used it three times for viruses and each time removing manually, I got it done…

Have a little patience and you WILL fix your computer.

DO NOT let the hackers win by making you buy a new computer or having to take it to a professional for fixing. You can do it yourself.

God Bless

By: Brian

Brian — Mon, 23 Nov 2009 17:38:41 +0000

ATTENTION!!!!
Once you start your computer and your screne pops up press ctrl alt dltright away, then follow the instructions on this site. Might take a while but you cann get it done.

What I did after the ctl alt dlt, was follow these instructions but it kept poping up. I sat there and watched the “processess” to see which ones were going off when the pop ups would come and then I just ended those processess. Do that and then follow the instructions here.

Also look through ALL these comments as there seems to be alot more things that need to be done by following along woth others.

YOU CAN DO IT!!!

God Bless

By: Luciana

Luciana — Mon, 23 Nov 2009 08:06:51 +0000

You may go through the manual removal guidelines just to check if some of the malicious files are still onboard.

By: Luciana

Luciana — Mon, 23 Nov 2009 08:04:09 +0000

Blocking malicious websites is not enough, you also need to delete files and registry entries installed by Antivirus System Pro. You should be able to access Task Manager and other system tools on a safe mode.

By: Luciana

Luciana — Mon, 23 Nov 2009 07:28:59 +0000

Thank you for this comment. We will update the manual removal guide as soon as possible.

By: Heather

Heather — Mon, 23 Nov 2009 03:10:45 +0000

…I love you.

I have been spending HOURS looking for a way to get rid of this program and NOTHING works… but with your solution, I fixed it in only a handful of minutes!

You, kind sir, are my saviour.

By: DRM

DRM — Sun, 22 Nov 2009 23:26:09 +0000

I was able to do a system restore, virus is not coming up now. Do I still need to follow try and remove virus? Will it return?

By: Stephan

Stephan — Sun, 22 Nov 2009 04:50:39 +0000

I think I got rid of this thing, but now I cannot access the internet at all – looks like the wireless connection is made but I get the ‘Internet Explorer cannot display the webpage” fault.

To get rid of this virus, I had to start up in Safe mode – I couldn’t open Task Manager, access any websites, etc. Did not find any of the processes or registries listed above (even with all hidden files showing), but found MXCJSYSGUARD.EXE and several websites and files called OSADWAREKILL2009. All were installed yesterday when the infection started. I deleted all those. I did not make any changes to the DLLs since I cou;dn’t find that specific one, but I blocked all the Antivirus System Pro websites in my HOST file. Now I don’t get the faults and windows popping up, but I cannot access the internet. Looks like Spyware Doctor still finds a significant Trojan, but I can’t remove it as I can’t register the Spyware Doctor as I can’t access the internet.

Any ideas?

By: DD

DD — Sat, 21 Nov 2009 05:15:15 +0000

Well I followed all the steps that you suggested in your tutorial but I can’t seem to find any of the files that are supposed to be deleted. Even the sites that were supposed to be blocked that I entered in the “host” thing weren’t blocked but I think that this virus site actually found a way to adapt agaisnt deleting now. So is there anything I can do other than installing/buying a program that will help me delete it?

By: Luciana

Luciana — Fri, 20 Nov 2009 08:00:49 +0000

You can download security tools on another computer and then copy the install files to the infected computer using usb drive.

By: allie

allie — Fri, 20 Nov 2009 07:37:52 +0000

I can’t even go to boot menu, and my laptop won’t let me delete the system32. every time it says it’s going to it never does I’ve tried deleting it over 123454 times already, and I have no computer/laptop to download the anti virus on, Im only on my cellphone internet right now and I need this fixed soon, because I do my school work on my laptop. please help, thanks.

By: Luciana

Luciana — Wed, 18 Nov 2009 09:45:43 +0000

Thank you for pointing out unclear sections of the tutorial. The article explains all the aspects you need to know while dealing with registry entries. You may need to know how to add new values and how to export a key/value. While removing Antivirus System PRO and most of other malware you only need to know how to delete registry entries.

By: kris

kris — Tue, 17 Nov 2009 20:06:28 +0000

Hi Walker,

Follow your way to rename iehelper.dll to iehelperFAKE.dll. Restart my computer, and it create another iehelper.dll. iehelperFake.dll can be deleted, but the new iehelper.dll still there and cannot be deleted. My computer detect
to find

Treat: SpywareProtect2009
File: C:\windows\system32\iehelper.dll
Location: unknown Storage

Since antivirus system pro has blocked Symantec software which is installed in my NB. So I doubt the message is fake.

So still cannot delete iehelper. Drive my crazy. HELP!!

By: kris

kris — Tue, 17 Nov 2009 14:38:00 +0000

How to delete registry entries?
http://www.spywarevoid.com/how-to-delete-registry-entries

I followed all the instruction from the very fist part to all of them.
It did work to remove antivirus system pro from my computer. You cannot imagine how excited I was. ( To a person with few computer tech knowledge like me, I’m freaking out and reformat and reinstall os etc… is a big thing. I was planning to get a computer shop to reformat my NB……)

But when I reboot the computer, the antivirus system pro is back again. So sad…..

I don’t know why…….

So I’m wondering maybe some parts I did weren’t correct or …..

I’m bit of confused with the part – How to delete registry entries?
(http://www.spywarevoid.com/how-to-delete-registry-entries)

Could you help to clarify below questions:

step a : Open Registry Editor. (clear)

step b: Navigate to find the needed registry key and value (clear)

step c: Select the value to modify it. (not clear)
Q: “Enter the new value”  is it to enter “1”? When you click modify, the original value is 1. So is it to enter “1” again??

step d: Find the value using the steps above and delete it. (clear)

step e: You may need to add a new value or a new key to the Windows registry. (not clear)

Q1: From the screenshot, the file “Opened” is still there. Why? Isn’t it deleted as
Step e?

Q2: To create a new value, I choose option “New” and then choose “DWORD value” . Is this correct? The screenshot shows New – Key. Is it to choose “Key” instead of “DWORD value” ? But it seems to choose “DWORD value”?

If choose “DWROD value”, it appear in right hand side. If choose “Key” it will show in the left hand side as a new folder. So which one to choose?

Is it possible the person who writes this article can make it clearer? It’s a great help to the person like me (with poor computer knowledge)

Step f: You may need to export certain key or value from the registry. (not clear)

Q1: As Step e creating a new value, but here the screenshot doesn’t show any new value or a new key. Just wondering the Step e and Step f are the other way round???

Step g: You can import missing or new values and keys. (clear)

PLEASE HEP !!!!!

By: Barry

Barry — Sun, 15 Nov 2009 19:53:44 +0000

Here’s a 5 minute fix. Click the ASP taskbar icon(the shield) to open the ASP main window. Right click “Properties”. You should be able to highlight the full location of the program ’s *sysguard.exe file. It’s the location listed under “Address (URL)”. You may only see 2 lines of the address, so you’ll need to left click-hold and highlight the address so you can drag down to see the final, randomly named folder and file name (ending in sysguard.exe). Write down the file path, restart in safe mode, then find the folder and file using “My Computer” or “Windows Explorer”. Delete the file, then the folder, then the “windows\system32\iehelper.dll” file. Restart in normal mode, run Malwarebytes and it should be over.

By: Joel D

Joel D — Sun, 15 Nov 2009 10:51:05 +0000

thanks for the instructions, i am the pinicle of computer illiterate, and managed to catch this thing in half an hour and remove it really effectively with this info… THANKS A BUNCH!!!!

and my condolences to all, those popups are hella annoying

By: Matt Wilcox

Matt Wilcox — Wed, 11 Nov 2009 14:33:07 +0000

I’m on XP, and mine was in the folder – c:/documents and settings/USERNAME/Local Settings/Application data/cmcuxi/pxfssysguard.exe.

Note the last folder and the four letters before the name appear to be randomly generated ones, so your’s might be different.

By: Sal

Sal — Wed, 11 Nov 2009 03:11:42 +0000

Believe I found variant, under new file name and location, in vista config, in directory \User\ (your user name goes here) \ AppData \ local \ mjlyfv . File name looks like ktwasysguard.exe. IF you can get into the Task manager during boot up, then stop this process named something like ktwasysguard.exe.
Also found in registry, delete both if found:
1) under “HKEY_CURRENT_USER\Software\AvScan ” (entire section?)
2) under “HKEY_CURRENT_USER\Software\Microsoft\WIndows\CurrentVersion\Run ” a key called something like jbuhrrdg containing the directory and file name of C:\user\…\AppData\local\mjlyfv\ktwasysguard.exe

By: Kelly

Kelly — Wed, 11 Nov 2009 00:22:53 +0000

THANK YOU!!!

Just got hit tonight with the AntiVirus System Pro. Contacted McAfee, who we have Total Protection Software from. Apparently NOT. The tech lady gave me some worthless info about how viruses are popping up every hour, every minute. Yes, I got a wee bit testy and asked how they managed to fix this when it just popped up in the last hour since it wasn’t sent to my computer to block it out. (I know, I hang my head). Got on my email, lo and behold, she sent me a link to fix it created back in March 2009. So they’ve known about it that long..grr.

It didn’t work. Contacted chat support… they told me I was stuck unless I wanted to spend an unimagineable amount of money to have them remove it for me. Or contact Dell and have them do it.

I turned to you….. You saved my computer from a certain death by sledgehammer!

We downloaded the link for the fix to a jump drive and transferred it to the infected computer. Naturally I encountered a million errors, it certainly did NOT want me to install the fix. It went wonderfully, until the blue screen of death at the end. I admit I was scared. Then restarted, got some BIOS information, and sent it on to Microsoft. Who knows what they’ll do with it. Regardless, got past that, and have not seen a red box since!!

THANK YOU!!! THANK YOU!!! THANK YOU!!!

By: adrian

adrian — Tue, 10 Nov 2009 19:20:13 +0000

what were the process names & where was the auto install file???

By: Dave from Idaho

Dave from Idaho — Tue, 10 Nov 2009 09:43:33 +0000

I found the processes by watching the CPU performance as the pop-up did its thing. I deleted it, followed the above directions, found some of the files listed and it seems to have solved it HOPEFULLY I will restore before I re-boot.

By: Jamie w

Jamie w — Tue, 10 Nov 2009 02:30:38 +0000

I noticed that they had changed the begining of the process names found 3 that where runnning. ended them and stoppes in its tracks but when reboot its back think I founf the auto install file for it hidden in a windows file. there where 4.

By: Morgan

Morgan — Sun, 08 Nov 2009 15:20:12 +0000

Well, I wasn’t able to find either of the processes given above in the process list. Also all but one of the “other files” to be deleted weren’t there. In addition, it will not allow me to unregister iehelper.dll, but I was able to delete it.

By: Struggling with removal

Struggling with removal — Sun, 08 Nov 2009 06:47:05 +0000

Are you sure of this? Have you had direct experience with Windows Defender working successfully in removing Antivirus System Pro malware?? I’m running a Windows Defender full system scan right now and it’s been going for 2 hours…I’m hoping it will remove this malware from my computer!

By: Toku

Toku — Fri, 06 Nov 2009 17:39:03 +0000

Thanks, this site worked great. I used the manual instructions. Also don’t forget to disable the system restore when deleting these files, just don’t make a mistake either.

By: Walker

Walker — Wed, 04 Nov 2009 04:53:26 +0000

to delete ‘iehelper.dll’ rename to something like ‘iehelperFAKE.dll’ then restart your computer and you can now delete

By: Re'vyn

Re'vyn — Sun, 01 Nov 2009 23:28:32 +0000

I went to task manager-processes and mine weren’t listed as sysguard or antivirsus system pro mine were listed as xrxftplt.exe and jxkksysguard.exe and i couldn’t find any of the files listed anywhere. Is it because of the name of the file is different do i need to search areas under a different name than antivirus system pro?

By: scott

scott — Sat, 31 Oct 2009 04:14:09 +0000

I am a newbie to all this as well. Just got hit with this one. I am able to get into safe mode on the affected computer and I am running a resotre to a date a couple of weeks ago. Do I have anything else I have to do after the restore is done? I did download the spy doctor file but when I when out for updates everything crashed…thus the restore I am doing now.

By: adnan

adnan — Fri, 30 Oct 2009 03:15:55 +0000

Hi, I can’t follow any of the recommendations listed, because this evil software is prohibiting safe mode, blocking the viewing of hidden files, blocking add/remove programs, blocking regedit. I literrally cannot do anything.

Please help!

By: Hai

Hai — Thu, 29 Oct 2009 05:09:08 +0000

I find AVScan in different registry than the one listed in the instructions above (HKEY_CURRENT_USER\Software\AvScan). Should I delete aVScan on any different registry? I appreciate any help I can get.

Thanks

By: Luciana

Luciana — Wed, 28 Oct 2009 07:47:36 +0000

Since Windows Defender detects Antivirus System Pro malware, it should be able to delete it.

By: Silver

Silver — Wed, 28 Oct 2009 01:02:37 +0000

I’m very frustrated because I have payed for Spyware Doctor to remove “Antivirus System Pro” from my computer. The first time, it was very easy and I was astonished by it’s capacities.

However, not even a week later the very same virus came back! This time, it kept on uninstalling my Spyware Doctor and when I re-installed it, it wasn’t able to start scanning because it was stuck on the “Checking” Mode. After much struggle, I was finally able to remove it and I believed the worst was over, but I was so very wrong.

Today again, while doing my usual routine intelli-scan with Spyware Doctor, it suddenly closed on me. Shocked, I tried to re-open it, but it was in vain. My computer could not find the program anymore. Then, for the third time now, Antivirus System Pro is creating havoc in my computer and for me. Again, my Spyware Doctor is unable to scan because it is constantly stuck on the “Checking Mode”. I’m not sure what do do anymore…

Also, I cannot run Spyware Doctor on Safe Mode because last time I tried, it gave me a blue screen saying that the virus was interrupting it from continuing on safe mode.

Thank you for your time and patience.

By: Hai

Hai — Wed, 28 Oct 2009 00:25:23 +0000

I have manually searched unsuccessfully for all the registries, DLL’s and EXE. files. However, Window Defender reportec that it has quarantined Antivirus System Pro. I am now plan to perform “system restore” to see if that AVSP is gone. Am I on the right track?

By: Barb

Barb — Mon, 26 Oct 2009 15:01:07 +0000

This might work, but as I said above it won’t let me into safe mode, not even with networking. I tried that first of all.

By: Luciana

Luciana — Mon, 26 Oct 2009 07:53:58 +0000

Take a look above the comments section to the “Antivirus System PRO manual removal instructions”. There are the names of files and processes listed along with explanation how to delete them.

By: Walt

Walt — Mon, 26 Oct 2009 05:39:34 +0000

As someone stated above, go into safe mode with networking:

Spam F8 as the system boots to the hard drive but BEFORE windows begins to load, if you miss it, start over.

Select safemode with networking (this will allow you to access the internet and reference pages such as this one)

Enter your admin password and voila.

Now you wont have to kill any of the services, they wont be running, and I didnt find 2/3rds of the registry entries this suggests. Also, mine was installed in a BS directory, something like “C:\program files\ukakgkashgfkaskfa”

What I recommend doing is opening the registry with regedit and search for specific phrases, “BAD4551D” for example. Be sure you are deleting the right entry, deleting the wrong one can have catastrophic results.

Anyway, I’m actually writing this as I’m finishing up the walk through.

Best of luck and thanks for posting the resolution.

Walt R.
I run The Planet, You’re welcome.

By: Terrance

Terrance — Sun, 25 Oct 2009 03:08:57 +0000

Wow. I am in the exact same situation. I go to the task manager and I don’t see it. I access temporary files and delete those, but one refuses to go. I found the iehelper.dll and tried to delete it but it says it’s in use! I have tried other antispy ware but my computer resists it. I almost wish I could make a virus eating virus that I can infect my own computer with. ER! Make it stop!!!

By: Ashley

Ashley — Fri, 23 Oct 2009 17:38:32 +0000

HELP! I can’t download the antivirus system pro removal tool, and am not savvy enough to know which malware processes to delete.

By: barb

barb — Thu, 22 Oct 2009 23:56:41 +0000

How do you get rid of this in the registry when the virus won’t let you get to the registry. It says the administator does not allow use of the registry and I am the administrator. It also won’t let me into safe mode. And they must have changed the name again, because none of the names to find are found on my computer. I went in and compared one computer to another and stopped all services that were not listed on the machine without the virus. This is a nasty bug, worse than the swine flu!

By: Luciana

Luciana — Tue, 20 Oct 2009 13:54:05 +0000

Delete files and registry entries like it’s described on the tutorial above the comments section.

By: AMAR

AMAR — Tue, 20 Oct 2009 13:39:09 +0000

i have tried everything but nothing worked…
please help how to remove these disgusting pop ups manually

By: Don Rulf

Don Rulf — Tue, 13 Oct 2009 21:10:01 +0000

I found the offending process to be “trtvsysguard.exe”, in my case. I tripped it by looking at the applications window in task manager for the bogus “virus removal” application, then redirecting to the process window where the above process was highlighted. Renaming the offending process to “trtvsysguard.dud” halted the madness upon reboot and allowed me to search the internet for help, eventually ending up here.

Thanks!

By: Raymond

Raymond — Fri, 09 Oct 2009 15:41:35 +0000

I had the same problem this morning and it kept popping on me, I went to All Programs–> Control Panel–> Add Remove programs and clicked on the first program that popped up , dont remember the name but some thing that came at the top and off it went..

I also had a Norton 360 installed on my computer and it gave me a msg that it blocked it but never removed it.

Thanks

Ray

By: Jun

Jun — Fri, 02 Oct 2009 20:53:33 +0000

Control Panel, Add-Remove Program, look for Antivirus Pro and installed date on right.
Go to Accesories, system tool, system restore, restore my pc to earlier time, click date back when your pc still working good.