Remove AntiVirus (Uninstall Guide)

  • March 26, 2010

AntiVirus is a ransomware program that is promoted through fake online scanners. Once installed AntiVirus will not allow you to run certain programs that include Internet Explorer, Notepad, Windows Media Player, and Task Manager. When you try to run these programs you will receive a message stating, with its spelling mistakes, that the "File is infected and CANNOT be exececuted". In order to clean these supposed infections you would need to send $5 dollars to the malware writers whose email is goldenpayments2010@yahoo.com. Once you send the money they will send you an activation key that will remove certain Windows Registry entries that will allow you to use these programs again. Please note that there is absolutely nothing wrong with your programs and you do not have any infections other than the AntiVirus program itself. The program is only trying to ransom your computer's proper operation so that you pay the $5 dollars.

AntiVirus will also be configured to start automatically when Windows starts. Once started it will scan your computer and state that there are numerous infections, but will not remove them unless you first pay the ransom. Some of the infection names that it will detect include:

trojan.win32.password-stealer-g trojan.win32.downloader-small-f trojan.win32.vundo-c trojan.win32.iehelper-a
trojan.win32.keylogger-h trojan.DOS.clicker-c adware.win32.fakeavalert-d! adware.win32.fake-antivirus-gen-c
  • AntiVirus screen shot
  • Minimized AntiVirus Agent
  • Web pop-up alert
  • Fake online anti-malware scanner
  • File is infected warning
  • Ransom message
  • Fake security alert

While running, you will also see a security alert that is constantly displayed on your desktop. The text of this alert, including spelling mistakes, is:

THREAT DETECTED!!

An attacker at port: 898 IP: 127.83.45 has hijacked your computer is probably gathering information now such browsing history and document data. Unfortunateley, your antivirus is unregistered and cannot remove this threat.

This alert, like the fake scan results, is just another tactic for the malware writers to scare you into thinking that your computer has a security problem so that you pay the ransom. Please ignore this alert and do not purchase the program for any reason.

As you can see, AntiVirus was created to scare you into thinking your computer has a problem with security alert and then ransoms the proper operation of certain programs so that you will pay the $5 dollars to the malware writers. It goes without saying that you should definitely not do so, and if you have, you should contact your bank or payment institution stating it was a scam. To remove AntiVirus and any related malware, please use the removal guide below.

Self Help Guide

This guide contains advanced information, but has been written in such a way so that anyone can follow it. Please ensure your data is backed up before proceeding.

If you are uncomfortable making changes to your computer or following these steps, do not worry! Instead you can get free one-on-one help by asking in the forums.
  1. For the first part of this removal guide you will need to use a different computer than the infected one unless you have a web browser other than Internet Explorer installed on the infected machine. If you are concerned about whether or not you can do this, do not be, as I have made these instructions easy to follow for people of any computer expertise.

  2. If you have another web browser, other than Internet Explorer, installed on the infected machine, please download RKill and save it to your desktop and skip to step 3. Otherwise, on a different clean computer insert your USB flash drive or external hard drive. Once the drive is recognized, you should have a new drive letter on your computer that is associated with this device. Please download RKill and save it to the external hard drive or a USB flash drive by saving it into the new drive letter. We will then use the external drive or flash drive to to transfer these files to your infected computer. If you do not own a USB flash drive, you can get one from any local or online computer store for a small price. Some examples of good and cheap ones can be found at Newegg and Best Buy. Please download RKill.com from the following link:

    RKill Download Link - (Download page will open in a new tab or browser window.)

    When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your flash drive or external hard drive.

  3. Once RKill.com is on the infected computers desktop, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with AntiVirus and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by AntiVirus when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that RKill can terminate AntiVirus . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide.

    Do not reboot your computer after running RKill as the malware programs will start again.


  4. At this point you should download Malwarebytes Anti-Malware, or MBAM, to scan your computer for any any infections or adware that may be present. Please download Malwarebytes from the following location and save it to your desktop:

    Malwarebytes Anti-Malware Download Link (Download page will open in a new window)

  5. Once downloaded, close all programs and Windows on your computer, including this one.

  6. Double-click on the icon on your desktop named mb3-setup-1878.1878-3.0.6.1469.exe. This will start the installation of MBAM onto your computer.

  7. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure you leave Launch Malwarebytes Anti-Malware checked. Then click on the Finish button. If MalwareBytes prompts you to reboot, please do not do so.

  8. MBAM will now start and you will be at the main screen as shown below.



    Malwarebytes Anti-Malware


    Please click on the Scan Now button to start the scan. If there is an update available for Malwarebytes it will automatically download and install it before performing the scan.

  9. MBAM will now start scanning your computer for malware. This process can take quite a while, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.



    Malwarebytes Anti-Malware


  10. When MBAM is finished scanning it will display a screen that displays any malware that it has detected. Please note that the infections found may be different than what is shown in the image below due to the guide being updated for newer versions of MBAM.


    MalwareBytes Scan Results


    You should now click on the Remove Selected button to remove all the seleted malware. MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.

  11. You can now exit the MBAM program.

Your computer should now be free of the AntiVirus programs. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future.

View Associated AntiVirus Files

c:\78gbc8r.exe c:\avinstaller1.exe c:\WINDOWS\000b09274b.exe c:\WINDOWS\chnb8895.exe

View Associated AntiVirus Registry Information

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "avagent3974" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "avguard3876" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\limewire.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus,Trojan,Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.

Login

Remember Me
Sign in anonymously