AntiVirus is a ransomware program that is promoted through fake online scanners. Once installed AntiVirus will not allow you to run certain programs that include Internet Explorer, Notepad, Windows Media Player, and Task Manager. When you try to run these programs you will receive a message stating, with its spelling mistakes, that the "File is infected and CANNOT be exececuted". In order to clean these supposed infections you would need to send $5 dollars to the malware writers whose email is firstname.lastname@example.org. Once you send the money they will send you an activation key that will remove certain Windows Registry entries that will allow you to use these programs again. Please note that there is absolutely nothing wrong with your programs and you do not have any infections other than the AntiVirus program itself. The program is only trying to ransom your computer's proper operation so that you pay the $5 dollars.
AntiVirus will also be configured to start automatically when Windows starts. Once started it will scan your computer and state that there are numerous infections, but will not remove them unless you first pay the ransom. Some of the infection names that it will detect include:
While running, you will also see a security alert that is constantly displayed on your desktop. The text of this alert, including spelling mistakes, is:
An attacker at port: 898 IP: 127.83.45 has hijacked your computer is probably gathering information now such browsing history and document data. Unfortunateley, your antivirus is unregistered and cannot remove this threat.
This alert, like the fake scan results, is just another tactic for the malware writers to scare you into thinking that your computer has a security problem so that you pay the ransom. Please ignore this alert and do not purchase the program for any reason.
As you can see, AntiVirus was created to scare you into thinking your computer has a problem with security alert and then ransoms the proper operation of certain programs so that you will pay the $5 dollars to the malware writers. It goes without saying that you should definitely not do so, and if you have, you should contact your bank or payment institution stating it was a scam. To remove AntiVirus and any related malware, please use the removal guide below.
Self Help Guide
If you are uncomfortable making changes to your computer or following these steps, do not worry! Instead you can get free one-on-one help by asking in the forums.
- For the first part of this removal guide you will need to use a different
computer than the infected one unless you have a web browser other than Internet
Explorer installed on the infected machine. If you are concerned about whether
or not you can do this, do not be, as I have made these instructions easy
to follow for people of any computer expertise.
- If you have another web browser, other than Internet Explorer, installed
on the infected machine, please download RKill
and save it to your desktop and skip to step 3. Otherwise,
on a different clean computer insert your USB flash drive or external hard
drive. Once the drive is recognized, you should have a new drive letter on
your computer that is associated with this device. Please download RKill
and save it to the external hard drive or a USB flash drive by saving it into
the new drive letter. We will then use the external drive or flash drive to
to transfer these files to your infected computer. If you do not own a USB
flash drive, you can get one from any local or online computer store for a
small price. Some examples of good and cheap ones can be found at Newegg
Buy. Please download RKill.com from the following link:
RKill Download Link - (Download page will open in a new tab or browser window.)
When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your flash drive or external hard drive.
- Once RKill.com is on the infected computers desktop,
double-click on the iExplore.exe icon in order to automatically
attempt to stop any processes associated with
and other Rogue programs. Please be patient while the program looks for various
malware programs and ends them. When it has finished, the black window will
automatically close and you can continue with the next step. If you get a
message that RKill is an infection, do not be concerned. This message is just
a fake warning given by
when it terminates programs that may potentially remove it. If you run into
these infections warnings that close RKill, a trick is to leave the warning
on the screen and then run RKill again. By not closing the warning, this typically
will allow you to bypass the malware trying to protect itself so that RKill
. So, please try running RKill until the malware is no longer running. You
will then be able to proceed with the rest of the guide.
Do not reboot your computer after running RKill as the malware programs will start again.
- At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following
location and save it to your desktop:
Malwarebytes Anti-Malware Download Link (Download page will open in a new window)
- Once downloaded, close all programs and Windows on your computer, including
- Double-click on the icon on your desktop named mb3-setup-1878.1878-220.127.116.119.exe.
This will start the installation of MBAM onto your computer.
- When the installation begins, keep following the prompts in order to continue
with the installation process. Do not make any changes to default settings
and when the program has finished installing, make sure you leave Launch
Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.
- MBAM will now start and you will be at the main screen as shown below.
Please click on the Scan Now button to start the scan. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.
- MBAM will now start scanning your computer for malware. This process can
take quite a while, so we suggest you do something else and periodically
check on the status of the scan to see when it is finished.
- When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different
than what is shown in the image below due to the guide being updated for newer versions of MBAM.
You should now click on the Remove Selected button to remove all the seleted malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.
- You can now exit the MBAM program.
Your computer should now be free of the AntiVirus programs. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.