Antivirus Agent Pro Removal Guide

Posted by Grinler on March 22, 2009 @ 02:31 PM · Views: 8,692

 

What this infection does:

Antivirus Agent Pro is a malvertised rogue anti-spyware program. When I say malvertised, that means that the program is advertised and installed through the use of malware and Trojans. Research has found that this program is installed by a Trojan called guard.exe, that when run, downloads and installs Antivirus Agent Pro on to your computer without your permission. Once installed, it will be configured to start automatically when Windows loads. When the program is started it will automatically scan your computer and detect numerous infections on your computer that will not be removed until you purchase the program. The programs it detects, though, are actually files that the rogue put on your computer in the first place. Furthermore, these supposed infections are harmless and cannot hurt your computer in any way. They are only being shown to scam you into thinking you are infected.

 

Antivirus Agent Pro screen shot
For more screen shots of this infection click on the image above.
There are a total of 4 images you can view.

 

The detection results that are given by Antivirus Agent Pro are hard coded so that regardless of the computer it is run on, it will always detect the same infections. The filenames may be different, but the infection types are not. Currently the infections this program states are on your computer are:

W32/Tpecid
Generic Dropper.de
Generic PWS.ar
FakeAlert-av360.dll
W32/Kavsp Virus
W32/Mariofev!enc
W32/Mokaksu
Danmec.b
Generic Dropper.bw
FakeAlert-av360
Exploit-MSWord.j
Downloader-BMF
BackDoor-DSG.dldr
W32/Waledac
W32/Sdbot.worm!3AFA6720
PWS-Gamania.gen.a!
W32/Conficker.worm.gen.b
W32/Conficker.worm.gen.a
VBS/IE-Title!C71CDCDC
W32/Conficker.worm!inf

If you are infected with this rogue, then please use the instructions below in order to remove this malware and the Trojans that installed it.

 

Threat Classification:

• Information on Rogue Programs & Scareware

 

Advanced information:

View Antivirus Agent Pro files.
View Antivirus Agent Pro Registry Information.

 

Tools Needed for this fix:

• Malwarebytes' Anti-Malware

 

Symptoms that may be in a HijackThis Log:

O4 - HKLM\..\Run: [Antivirus Agent Pro] C:\Program Files\Antivirus Agent Pro\aap.exe

 

Guide Updates:

03-22-09 - Initial guide creation.

 

---

Automated Removal Instructions for Antivirus Agent Pro using Malwarebytes' Anti-Malware:

 

1. Print out these instructions as we will need to close every window that is open later in the fix.
   
   
2. Download Malwarebytes' Anti-Malware, or MBAM, from the following location and save it to your desktop:
   
   Malwarebytes' Anti-Malware Download Link (Download page will open in a new window)
   
   


3. Once downloaded, close all programs and Windows on your computer, including this one.
   
   
4. Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MBAM onto your computer.
   
   
5. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware checked. Then click on the Finish button.
   
   
6. MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan. As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.
   
   
   
   
   
   
   
7. On the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer for Antivirus Agent Pro related files.
   
   
8. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
   
   
   
   
   
   
   
9. When the scan is finished a message box will appear as shown in the image below.
   
   
   
   
   
   
   You should click on the OK button to close the message box and continue with the AntivirusAgentPro removal process.
   
   
10. You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
    
    
11. A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
    
    
    
    
    
    
    
    You should now click on the Remove Selected button to remove all the listed malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.
    
    
12. When MBAM has finished removing the malware, it will open the scan log and display it in Notepad. Review the log as desired, and then close the Notepad window.
    
    
13. You can now exit the MBAM program.
    

Your computer should now be free of the AntivirusAgentPro program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

 

---

 

Associated Antivirus Agent Pro Files:

Note: Some of these file names and locations may be random.:

c:\Program Files\Antivirus Agent Pro
c:\Program Files\Antivirus Agent Pro\aap.exe
c:\Program Files\Antivirus Agent Pro\aapcn.dll
c:\Program Files\Antivirus Agent Pro\rt.sys
c:\Program Files\ChmDecompiler\cm.89
c:\Program Files\Movie Maker\7o.jf
c:\Program Files\Mozilla Firefox\w32.f3k
c:\Program Files\NetMeeting\g5l2.gr
c:\Program Files\WinPcap\8zjq8.8e
c:\WINDOWS\$NtUninstallKB942763$\c2.k5
c:\WINDOWS\Config\m458j.hah
c:\WINDOWS\java\tnv0.jv
c:\WINDOWS\msagent\so.jw
c:\WINDOWS\network diagnostic\vneps.7nx

 

Associated Antivirus Agent Pro Windows Registry Information:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Agent Pro"