Remove AntiVirus (Uninstall Guide)
Posted by Lawrence Abrams on March 26, 2010 @ 11:18 AM · Views: 13,673
What this infection does:
AntiVirus is a ransomware program that is promoted through
fake online scanners. Once installed AntiVirus will not allow you to run certain
programs that include Internet Explorer, Notepad, Windows Media Player, and
Task Manager. When you try to run these programs you will receive a message
stating, with its spelling mistakes, that the "File is infected and CANNOT
be exececuted". In order to clean these supposed infections you would need
to send $5 dollars to the malware writers whose email is goldenpayments2010@yahoo.com.
Once you send the money they will send you an activation key that will remove
certain Windows Registry entries that will allow you to use these programs again.
Please note that there is absolutely nothing wrong with your programs and you
do not have any infections other than the AntiVirus program itself. The program
is only trying to ransom your computer's proper operation so that you pay the
$5 dollars.
AntiVirus will also be configured to start automatically when Windows starts.
Once started it will scan your computer and state that there are numerous infections,
but will not remove them unless you first pay the ransom. Some of the infection
names that it will detect include:
| trojan.win32.password-stealer-g |
trojan.win32.downloader-small-f |
trojan.win32.vundo-c |
trojan.win32.iehelper-a |
| trojan.win32.keylogger-h |
trojan.DOS.clicker-c |
adware.win32.fakeavalert-d! |
adware.win32.fake-antivirus-gen-c |
AntiVirus screen shot
For more screen shots of this infection click on the image above.
There are a total of 7 images you can view.
While running, you will also see a security alert that is constantly displayed
on your desktop. The text of this alert, including spelling mistakes, is:
THREAT DETECTED!!
An attacker at port: 898 IP: 127.83.45 has hijacked
your computer is probably gathering information now such browsing history
and document data. Unfortunateley, your antivirus is unregistered and cannot
remove this threat.
This alert, like the fake scan results, is just another tactic for the malware
writers to scare you into thinking that your computer has a security problem
so that you pay the ransom. Please ignore this alert and do not purchase the
program for any reason.
As you can see, AntiVirus was created to scare you into thinking your computer
has a problem with security alert and then ransoms the proper operation of certain
programs so that you will pay the $5 dollars to the malware writers. It goes
without saying that you should definitely not do so, and if you have, you should
contact your bank or payment institution stating it was a scam. To remove AntiVirus
and any related malware, please use the removal guide below.
Threat Classification:
Advanced information:
View AntiVirus files.
View AntiVirus Registry Information.
Tools Needed for this fix:
Symptoms that may be in a HijackThis Log:
O4 - HKCU\..\Run: [avguard3876] C:\Windows\000b09274b.exe
O4 - HKCU\..\Run: [avagent3974] C:\Windows\chnb8895.exe
Guide Updates:
03/26/10 - Initial guide creation.
Automated Removal Instructions for AntiVirus using Malwarebytes' Anti-Malware:
- For the first part of this removal guide you will need to use a different
computer than the infected one unless you have a web browser other than Internet
Explorer installed on the infected machine. If you are concerned about whether
or not you can do this, do not be, as I have made these instructions easy
to follow for people of any computer expertise.
- If you have another web browser, other than Internet Explorer, installed
on the infected machine, please download RKill
and save it to your desktop and skip to step 3. Otherwise,
on a different clean computer insert your USB flash drive or external hard
drive. Once the drive is recognized, you should have a new drive letter on
your computer that is associated with this device. Please download RKill
and save it to the external hard drive or a USB flash drive by saving it into
the new drive letter. We will then use the external drive or flash drive to
to transfer these files to your infected computer. If you do not own a USB
flash drive, you can get one from any local or online computer store for a
small price. Some examples of good and cheap ones can be found at Newegg
and Best
Buy. Please download RKill.com from the following link:
RKill
Download Link - (Download page will open in a new tab or browser window.)
When at the download page, click on the Download Now button
labeled iExplore.exe download link. When you are prompted
where to save it, please save it on your flash drive or external hard drive.
- Once RKill.com is on the infected computers desktop,
double-click on the iExplore.exe icon in order to automatically
attempt to stop any processes associated with
AntiVirus
and other Rogue programs. Please be patient while the program looks for various
malware programs and ends them. When it has finished, the black window will
automatically close and you can continue with the next step. If you get a
message that RKill is an infection, do not be concerned. This message is just
a fake warning given by
AntiVirus
when it terminates programs that may potentially remove it. If you run into
these infections warnings that close RKill, a trick is to leave the warning
on the screen and then run RKill again. By not closing the warning, this typically
will allow you to bypass the malware trying to protect itself so that RKill
can terminate
AntiVirus
. So, please try running RKill until the malware is no longer running. You
will then be able to proceed with the rest of the guide.
Do not reboot your computer after running RKill as the malware programs will
start again.
- Now you should download Malwarebytes' Anti-Malware, or MBAM, from the following
location and save it to your desktop:
Malwarebytes' Anti-Malware Download Link
(Download page will open in a new window)
- Once you have downloaded all the necessary files to a removable device,
you need to plug it into your infected computer so it can access them.
- Now you should be able to run the mbam-setup.exe file
that you saved on your removable media in step 2. Double-click on this file
to install MalwareBytes' on to your computer. When the installation begins,
keep following the prompts in order to continue with the installation process.
Do not make any changes to default settings and when the program has finished
installing, make sure you leave both the Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware checked.
Then click on the Finish button. If you already have MalwareBytes'
installed, simply launch it now and continue to step 8.
- MBAM will now automatically start and you will see a message stating that
you should update the program before performing a scan. As MBAM will automatically
update itself after the install, you can press the OK button
to close that box and you will now be at the main program as shown below.
- On the Scanner tab, make sure the the Perform
full scan option is selected and then click on the Scan
button to start scanning your computer for
AntiVirus
related files.
- MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you go and do something else and periodically
check on the status of the scan. When MBAM is scanning it will look like the
image below.
- When the scan is finished a message box will appear as shown in the image
below.
You should click on the OK button to close the message box and continue with
the
AntiVirus
removal process.
- You will now be back at the main Scanner screen. At this point you should
click on the Show Results button.
- A screen displaying all the malware that the program found will be shown
as seen in the image below. Please note that the infections found may be different
than what is shown in the image.
You should now click on the Remove Selected button to remove
all the listed malware. MBAM will now delete all of the files and registry
keys and add them to the programs quarantine. When removing the files, MBAM
may require a reboot in order to remove some of them. If it displays a message
stating that it needs to reboot, please allow it to do so. Once your computer
has rebooted, and you are logged in, please continue with the rest of the
steps.
- When MBAM has finished removing the malware, it will open the scan log and
display it in Notepad. Review the log as desired, and then close the Notepad
window.
- You can now exit the MBAM program.
Your computer should now be free of the
AntiVirus
programs. If your current anti-virus solution let this infection through,
you may want to consider purchasing the
PRO version of Malwarebytes' Anti-Malware to protect against these types
of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help
Associated AntiVirus Files:
c:\78gbc8r.exe
c:\avinstaller1.exe
c:\WINDOWS\000b09274b.exe
c:\WINDOWS\chnb8895.exe
Associated AntiVirus Windows Registry Information:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "avagent3974"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "avguard3876"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\limewire.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe
RSS
