Anti-Malware Assistant

Smart Fortress 2012 virus - Removal Guide

2012-03-29T12:02:00.001+03:00

Smart Fortress 2012 - Very advanced virus extortionist.

It is very difficult to get rid of it, but the way is still there.

Icon of Smart Fortress 2012

Main window of Smart Fortress 2012

Fake Warning by Smart Fortress 2012

HOW TO GET RID OF THIS TERRIBLE VIRUS

Step 1.

Press WinKey + R

Step 2.

Type http://trojan-killer.net/download/pkiller.exe
and press Enter key to download pkiller tool.

Step 3.

Right mouse click on the PKiller icon and select Run as...

Step 4.

Uncheck a checkbox as shown on screenshot.
And click OK.

Step 5.

Repeat steps 3 and 4 untill you see this message.
If you see this message then the virus was terminated.

DO NOT CLOSE THE PROCESS KILLER WINDOW

TO COMPLETE ENTIRE PROCESS OF VIRUS REMOVAL.

Step 6.

Now you can open your Internet Browser and download the Trojan-Killer
Run and install it.

Step 7.

After installation of Trojan Killer run a scan.

Step 8.

When scaning is complete. Click on Remove Selected button as shown on a screen.

Thats all. You can reboot your PC and make sure that the virus is removed.

Additional information.

Files created by virus:

C:\Documents and Settings\<UserName>\Desktop\Smart Fortress 2012.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Smart Fortress 2012\Smart Fortress 2012.lnk
C:\Documents and Settings\All Users\Application Data\<RandomNameFolder>\<RandomNameFile>.exe

Internet Security Virus - Easy Remove

2012-02-22T16:50:00.000+02:00

Internet Security - It's a Fake AV (Rogue, Virus, Malware) that blocks Task Manager and other programs.
It show a fake messages about infections on your PC and wish a money for disinfect it, but don't cure it.

Internet Security Icon

Internet Security main window

IS'T EASY WAY TO DELETE THIS VIRUS

Step 1.

Open "Start menu" and click on "Run" icon as shown in screenshot.
In command line type "taskkill /f /im isecurity.exe" as shown in screenshot and press Enter.

Step 2.

Go to the Trojan-Killer.net and download Trojan-Killer programm.

Step 3.

Install Trojan-Killer

Step 4.

After installation run it

Step 5.

Wait until the scanning process is completed

Step 6.

After scaning click on "Remove Selected"

Thats all. Good bye :) I hope this guide helps you to remove this terrible virus.

Additional information
Files:
C:\Documents and Settings\All Users\Application Data\isecurity.exe
C:\Documents and Settings\All Users\Desktop\Internet Security.lnk

Registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Internet Security" = "C:\Documents and Settings\All Users\Application Data\isecurity.exe"

System Check Virus - How To Get Rid

2012-02-17T17:08:00.000+02:00

System Check - It's Fake AV (Rogue, Virus, Malware). Just ransom money, nothing more.

System Check icon

Fake Errors

One more message

System Check main window

Effects of virus activity. All icons from Start menu and desktop are dissapeared.

HOW TO GET RID OF THE SYSTEM CHECK VIRUS

Step 1.

Press WinKey + R

Step 2.

In the opened command line type http://trojan-killer.net end press Enter

Step 3.

Download Trojan-Killer and run it.

Step 4.

Install Trojan-Killer

Step 5.

Run after installing

Step 6.

Wait while Trojan-Killer updade

Step 7.

After update scaning start automaticaly

Step 8.

Remove selected viruses

Step 9.

Run restore tool, and reset IE settings

Step 10.

Restart your PC

I HOPE THIS GUIDE HELPS YOU TO DELETE SYSTEM CHECK VIRUS :)

Additional Information.
System Check virus saved in hard disk with random named:
elXE7O7kJEBqT2.exe, HjLoCTYovD.exe, 6Hiyf0CT8BQuRB.exe, aSlILEXTGK87pa.exe, bR10hjnBB0Lpl.exe, ctsPWQNgCGxQAM.exe, dJfESasFBfaCsH.exe, fSTdkdZMtxFJkF.exe, ghxSJLETyoE.exe, GViAGAIDJIj.exe, hlBQa4E0touTaM.exe, IFEvuifXpHuouiv.exe, NjnSXj2tuRoKUS7.exe, rlETiIymYqlcUo6.exe, tauWkXtJMV9Db16.exe, ZQLvmgjdesHXTo2.exe, ZQLvmgjdesHXTo.exe, LoBoUYvVYw.exe, OgpDDLdaoq.exe, pBdLGFtTPyTq4K.exe, I97Lhx0Ur44APQ.exe, gVCMtk2aAKoij7.exe, vkYWHap0CdYhWW.exe, muNojdbroJgYEBX.exe, aPPhFOdsiSvcW7.exe, BHMmHjYKMAcfJ.exe, 0ewnDCcYZm4iD3.exe, gIknGA87xxJsXw.exe, PiGUNCilaeLmpu.exe, dpJPDS5zQXezbA.exe, xImULAUPBbuJP.exe, Jv4J8k9ZI2dNK6.exe, DeWkPGfSKxJfrv.exe, mPEEtw0FBFwhHE.exe, 9Zh9PqXYrplTPt.exe, 1O2o5Lb6LBhKTu.exe, FtY2mOkk7pve3M.exe, hhBUqpMjwRyef.exe, Wseuh3qsrMaNwj.exe, A1RX7zy8DgkpIQ.exe, 1MBJNfryNudaBx.exe, d2hl1WNdwFUQTx.exe, Y5Jt54B3tgxAhj.exe, 6sMTpXHIHIDMiu.exe, FNUpoBDe7Eh4nB.exe, oY80E0A3oE8428.exe, yiaYdRfrCjDkrP.exe, Q8Jj92og9IaiOP.exe, gnvI5aAHmNSLWb.exe, fPa6UdkhxeC6yN.exe, wbwILJy9bS5PBx.exe, LWhRvhHGnxlb4Z.exe, RhXKiTAQTdkfUsv.exe, D6nJ6QgLH4n7uj.exe, dAhFAvypmBDkGG.exe, MkZgT5YT24PhUu.exe, dwVTehTVyfVwUz.exe, wU4PAImT4vqv8b.exe, EBwohSmD2z5slH.exe, UeTjQalhkrwo31.exe, stTb6fzDOvR36S.exe, rZUjMC9UfwQjpi.exe, aKOdSYRlPw.exe, cwuKGCkVOILNu.exe, gvSR04lzAEFGnF.exe, zzlugUg198bjnN.exe, HtwXTICLskgoqa.exe, pgR68QKlA82AiX.exe, YSKyBGXKufhzjl.exe, 0Qnpcw6RN2fTfT.exe, l5Yvpgc7IHOvPG.exe, fFldlHRWjE.exe, xPjxtTsYl3qJDo.exe, dGjFaowmJSBwz3.exe, 5dav05veeegnfd.exe, 7bBESB2WJxbbog.exe, 1kAlMiG2Kb7FzP.exe, eu3fxtu7k.exe, 5dAv05veEEGnFD.exe, 11LgbhuIEemvEx.exe, yRXawHVrgFKjit.exe, E44VUIbrfRPsIe.exe, tK7RR9NkXHeupu.exe, 99WEo1VbBLlrIJ.exe, tDSwR0FVohJmhD.exe, zc24Lp02GXSZrk.exe, ey4oNJqwOgBclX.exe, OgpDDLdaoq.exe, QngLqBh4Uh1mgg.exe, n34qmiGOCOItaN.exe, D8opXeiXM6oZKx.exe, dAhFAvypmBDkGG.exe, fRWQFf1xHcKXXG.exe, CZ7L11beLoDUSv.exe, 7F6SrcE5kfgCsr.exe, YVg6j6ft7eFowM.exe, 0EoGlhpqfMk2xW.exe, E73VRiLGP6pkpb.exe, JG3U7FYhmzpZlA.exe, FB6Sx3NDGppDU6.exe, QXrnnZ0f2CPURj.exe, Njw6dU5SyvPhic.exe, NiEPAkXfDEhi.exe, BUYb1NLnpjLHYp.exe, vAYW5uxswcccap.exe, 9MVWHoNhOzAqZp.exe, DvhhCCFbLujqW.exe, MDpvuKDqT0HQQt.exe, aoJdsIXIjoqyd.exe, wpyigYDfWj.exe, KJLp67ulyEdtFU.exe, 9SMCCuIkakzNz5.exe, qLYEwoUwbT.exe, CdYe4VFba1YyaC.exe, pDCFmzrI4KSE4N.exe, p3efvXR0ndPmPU.exe, xP86UelhhDds5G.exe, ISj5jP7c6wL1pZ.exe, FEPXvquGMaIdUNF.exe, WzEjZgxQwuruPE.exe, om2V5ciGsylbbO.exe, FEPXvquGMaIdUNF.exe, i26UVs4aaKWhOj.exe, HxiSncYsv2876J.exe, 7BGJbkbrQmhgpf.exe, fA4nFAWTifUL9y.exe and other.

Smart Protection 2012 - FAKE AV - ROGUE

2012-01-23T12:06:00.000+02:00

Smart Protection 2012 - FAKE AV - Removal Guide

Files created:

C:\Documents and Settings\<UserName>\Desktop\Smart Protection 2012.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Smart Protection 2012\Smart Protection 2012.lnk
C:\Documents and Settings\All Users\Application Data\<RandomFolder>\<RandomNumericFile>.exe

Register edit:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\<RandomNumericName> C:\Documents and Settings\All Users\Application Data\<RandomFolder>\<RandomNumericFile>.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Protection 2012\DisplayIcon C:\Documents and Settings\All Users\Application Data\<RandomFolder>\<RandomNumericFile>.exe,0
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Protection 2012\DisplayName Smart Protection 2012
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Protection 2012\ShortcutPath "C:\Documents and Settings\All Users\Application Data\<RandomFolder>\<RandomNumericFile>.exe" Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Protection 2012\UninstallString "C:\Documents and Settings\All Users\Application Data\<RandomFolder>\<RandomNumericFile>.exe" Uninstall

How to remove Smart Protection 2012

First of all you should download anti-trojan software Trojan-Killer.

Virus can block any runing programs. But you can rename install of trojan-killer to "explorer.exe" and it's should be run normally.

Run and install it.

Upon completion of installation, uncheck the Launch GridinSoft Trojan Killer checkbox and click Finish.

Why we did not run Trojan-Killer after installation? Becouse Smart Protection 2012 block all application exclude explorer.exe.

Next step to delete Smart Protection 2012 will be rename of Trojan-Killer to explorer.exe :)

Go to the folder where Trojan-Killer installed and rename "trojankiller.exe" to "explorer.exe".

Then you can run Trojan-Killer and scan your system.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

Super AV - Fake AV - rogue

2011-12-28T10:23:00.000+02:00

Super AV - Fake AV - Rogue

Files:
C:\WINDOWS\atexbees.exe

Register:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Security" = "C:\Windows\atexbees.exe"

Security Monitor 2012

2011-12-14T14:21:00.000+02:00

Security Monitor 2012 - it's fake antivirus. It's a rogue that found false detects on your PC and ransom money for healing computer.

Virus create next files:

%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Monitor.lnk

%AppData%\Security Monitor\IcoActivate.ico

%AppData%\Security Monitor\IcoHelp.ico

%AppData%\Security Monitor\IcoUninstall.ico

%AppData%\Security Monitor\Security Monitor.exe

%AppData%\Security Monitor\securityhelper.exe

%AppData%\Security Monitor\securitymanager.exe

%Desktopdir%\Security Monitor.lnk

%StartMenu%\Programs\Security Monitor\Activate Security Monitor.lnk

%StartMenu%\Programs\Security Monitor\Help Security Monitor.lnk

%StartMenu%\Programs\Security Monitor\How to Activate Security Monitor.lnk

%StartMenu%\Programs\Security Monitor\Security Monitor.lnk

%StartMenu%\Programs\Security Monitor.lnk

Registry edit:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

[Security Monitor] = "\"C:\\Documents and Settings\\Admin\\Application Data\\Security Monitor\\Security Monitor.exe\" /STARTUP"

[Security Monitor 2012 Security] = "C:\\Documents and Settings\\Admin\\Application Data\\Security Monitor\\securitymanager.exe"

Remove this virus very easy. Just read next guides:

1. General information about trojans and viruses

2. How to kill process from memory

3. How to remove programs from startup

4. How to define malicious program or not

I hope my guides help you to clean your PC from viruses and trojans.

AV Protection 2011 - FakeAV - REMOVAL GUIDE

2011-11-17T14:08:00.002+02:00

AV Protection 2011 - it is fake antivirus. Only money ransom.

Files are created:

C:\Documents and Settings\<UserName>\Application Data\FCE03\0FD4B.exe
C:\Documents and Settings\<UserName>\Application Data\FCE03\3F0D.CE0
C:\Documents and Settings\<UserName>\Application Data\LUUJ1wscH0aTNzF\AV Protection 2011.ico
C:\Documents and Settings\<UserName>\Application Data\dwme.exe
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Desktop\AV Protection 2011.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\dwme.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\AV Protection 2011\AV Protection 2011.lnk
C:\Program Files\03F0D\lvvm.exe
C:\Program Files\LP\4B7F\027.exe
C:\Program Files\LP\4B7F\2.tmp
C:\Program Files\LP\4B7F\3.tmp
C:\Program Files\LP\4B7F\4.tmp
C:\WINDOWS\system32\AV Protection 2011v121.exe

Registry edit:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"027.exe" = "C:\Program Files\LP\4B7F\027.exe"
"ZikkWC6uQ" = "C:\Documents and Settings\<UserName>\Application Data\dwme.exe"
"wbbIK2edvJwcHqT8234A" = "C:\WINDOWS\system32\AV Protection 2011v121.exe"

Random key names.

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you :)

Privacy Protection - Removal Guide ( FakeAV Rogue )

2011-11-10T15:53:00.001+02:00

Privacy Protection - dangerous virus, also known as FakeAV or Rogue. It block most of all programs and you can't to do anything.

To remove this virus first of all you need kill them from memory.

Click "Start" menu and select "Run" option. Type-in the following text exactly as it is specified here:
taskkill.exe /F /IM privacy.exe

This will kill the process of Privacy Protection virus. (if you could not do it from the first attempt then try again)

When the virus outside of memory you can do something to remove it from you PC forever.

Go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.

Press the Remove Selected to remove them.

Files are created:
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\All Users\Application Data\privacy.exe
C:\Documents and Settings\All Users\Desktop\Privacy Protection.lnk

Register:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
Privacy Protection = C:\Documents and Settings\All Users\Application Data\privacy.exe

AV Security 2012 - How To Remove - FakeAV - Rogue

2011-11-09T10:32:00.004+02:00

AV Security 2012 - it is fake antivirus. Only money ransom.

Files are created:
C:\Documents and Settings\<UserName>\Application Data\iEEDV8olEViWC\AV Security 2012.ico (It's random folder name)
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Desktop\AV Security 2012.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\<UserName>\Start Menu\Programs\AV Security 2012\AV Security 2012.lnk
C:\WINDOWS\system32\AV Security 2012v121.exe
(Will be possible to meet such a file C:\WINDOWS\system32\virus.exe)

Registry edit:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"qxxTGN9pR8234A"="C:\WINDOWS\system32\AV Security 2012v121.exe"

Random key names.

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you :)

System Security 2012 FakeAV How To Remove

2011-11-08T10:40:00.003+02:00

System Security 2012 - it is fake antivirus. Only money ransom.

Files are created:
C:\Documents and Settings\<UserName>\Application Data\dwme.exe
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Application Data\rCC66jQAXymZtn3\System Security 2012.ico (It's random folder name)
C:\Documents and Settings\<UserName>\Desktop\System Security 2012.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\dwme.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\System Security 2012\System Security 2012.lnk
C:\WINDOWS\system32\pttggOL3r.exe (It's random file name)
C:\WINDOWS\system32\System Security 2012v121.exe

Registry edit:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gXX5yhmP4tnLrI28234A" = "C:\WINDOWS\system32\D888oFB8lEViW6j.exe"
"PDVV8olDViWCuQh" = "C:\Documents and Settings\<UserName>\Application Data\dwme.exe"

Random key names.

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you :)

System Security 2011 - Fake AV - Rogue - Removal Guide

2011-10-31T17:28:00.000+02:00

System Security 2011 - it is fake antivirus. Only money ransom.

Files are created:

C:\Documents and Settings\<UserName>\Application Data\GRRFB8olDViWCkC\System Security 2011.ico (It's random folder name)
C:\Documents and Settings\<UserName>\Application Data\dwme.exe
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Desktop\System Security 2011.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\dwme.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\System Security 2011\System Security 2011.lnk
C:\WINDOWS\system32\D888oFB8lEViW6j.exe (It's random file name)

Registry edit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gXX5yhmP4tnLrI28234A" = "C:\WINDOWS\system32\D888oFB8lEViW6j.exe"
"PDVV8olDViWCuQh" = "C:\Documents and Settings\<UserName>\Application Data\dwme.exe"

Random key names.

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you :)

Windows XP Repair - Fake AV Removal Guide

2011-10-25T16:15:00.000+03:00

The "Windows XP Repair" Fake AV hides all files and folders, and brings all the shortcuts in a some folder.

So that would find anything on your computer to show hidden files and folders.
To do this, open My Computer. In the menu click Tools - Folder Options.

Click the tab View. Scroll to the "Show hidden files and folders", select this option and click OK.

Now you can see the files and folders that were hidden in a consequence of virus infection.

Now again run My Computer and type in the address bar website trojan-killer.net and press Enter.

On this site you will need to download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

Files created:

C:\Documents and Settings\All Users\Application Data\HCPnpjMsSrIRBiL.exe
C:\Documents and Settings\All Users\Application Data\14147364.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\Windows XP Repair\Windows XP Repair.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Windows XP Repair\Uninstall Windows XP Repair.lnk
C:\Documents and Settings\<UserName>\Desktop\Windows XP Repair.lnk

Registry key created:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HCPnpjMsSrIRBiL"="C:\Documents and Settings\All Users\Application Data\HCPnpjMsSrIRBiL.exe"

Also I recommend you to read this guides:
General information about viruses and trojans
How to kill process from memory
How to remove programs from startup
How to define malicious program or not

System Restore - Fake AV - Rogue - How to remove

2011-10-14T10:39:00.032+03:00

Rogue System Restore hides all files and folders, and brings all the shortcuts in a some folder.

So that would find anything on your computer to show hidden files and folders.
To do this, open My Computer. In the menu click Tools - Folder Options.

Click the tab View. Scroll to the "Show hidden files and folders", select this option and click OK.

Now you can see the files and folders that were hidden in a consequence of virus infection.

Now again run My Computer and type in the address bar website trojan-killer.net and press Enter.

On this site you will need to download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

Files created:
C:\Documents and Settings\<UserName>\Application Data\Microsoft\Internet Explorer\Quick Launch\System Restore.lnk
C:\Documents and Settings\<UserName>\Desktop\System Restore.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\2.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\P1kAlMiG2Kb7Fz.exe.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\P5tM1QBI6DSS92.exe.tmp
C:\ProgramData\1kAlMiG2Kb7FzP.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\System Restore\System Restore.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\System Restore\Uninstall System Restore.lnk
C:\Documents and Settings\All Users\Application Data\wkocffmpai
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
C:\Documents and Settings\All Users\Application Data\wkocffmpai.exe (or opYeyfNfgoELQR.exe, MipGepTjgvGvb.exe, VeGeMHdmoTmIHU.exe, nFEDeRLYbhvow.exe, nkvdydMXkOjUTm.exe, VBiiKvMvycJo.exe, nGAJwRsisPtsC.exe, lcfPLNqtMDTx.exe, kMoUUJmEvJ.exe, beUBhsyFTRXwF.exe, mNapNprtKQL.exe, GaRJGgXVekDX.exe, SkMtEGuPVoS.exe, KpLRDMpSNRdCe.exe, EwXTzauZm.exe, FuxUSdPsKW.exe, PubpyGvxbEEjj.exe)

Registry key created:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"wkocffmpai.exe"="C:\Documents and Settings\All Users\Application Data\wkocffmpai.exe" (or opYeyfNfgoELQR.exe, MipGepTjgvGvb.exe, VeGeMHdmoTmIHU.exe, nFEDeRLYbhvow.exe, nkvdydMXkOjUTm.exe, VBiiKvMvycJo.exe, nGAJwRsisPtsC.exe, lcfPLNqtMDTx.exe, kMoUUJmEvJ.exe, beUBhsyFTRXwF.exe, mNapNprtKQL.exe, GaRJGgXVekDX.exe, SkMtEGuPVoS.exe, KpLRDMpSNRdCe.exe, EwXTzauZm.exe, FuxUSdPsKW.exe, PubpyGvxbEEjj.exe)

How to restore all hidden files and deleted labels after virus?

Download and run next tools

GridinSoft Restore download link:
http://trojan-killer.net/download/restore.exe

GridinSoft Unhider download link:
http://trojan-killer.net/download/unhider.exe

Also I recommend you to read this guides:
General information about viruses and trojans
How to kill process from memory
How to remove programs from startup
How to define malicious program or not

Security Sphere 2012 - Rogue Fake AV - How to remove

2011-10-12T16:33:00.001+03:00

Security Sphere 2012 - Fake AV. Removal Guide.

Files Created:

C:\Documents and Settings\All Users\Application Data\kL05366HhJaC05366\kL05366HhJaC05366.exe

Registry edit:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Key: "kL05366HhJaC05366" = "C:\Documents and Settings\All Users\Application Data\kL05366HhJaC05366\kL05366HhJaC05366.exe"

How to remove Security Sphere 2012.
First of all you should download anti-trojan software Trojan-Killer.

Run and install it.

Upon completion of installation, uncheck the Launch GridinSoft Trojan Killer checkbox and click Finish.

Why we did not run Trojan-Killer after installation? Becouse Security Sphere 2012 block all application exlude explorer.exe.

Next step to delete Security Sphere 2012 will be rename of Trojan-Killer to explorer.exe :)

Go to the folder where Trojan-Killer installed and rename trojankiller.exe to explorer.exe.

Then you can run Trojan-Killer and scan your system.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you to kill Rogue Security Sphere 2012 :)

Cloud Protection - Rogue, Fake Anti Virus, Ransomware. Delete Guide.

2011-10-10T15:30:00.004+03:00

Cloud Protection - it is fake antivirus. Only money ransom.

Files are created:

C:\Documents and Settings\<UserName>\Application Data\g44tgnOLrfI2dJw\Cloud Protection.ico
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Desktop\Cloud Protection.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\2.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\svhostu.exe
C:\Documents and Settings\<UserName>\Start Menu\Programs\Cloud Protection\Cloud Protection.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Startup\crss.exe
C:\Program Files\Internet Explorer\1.tmp
C:\WINDOWS\system32\D88olEDV7kS7kSu.exe

Registry edit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tAAX5yhmP4gO3fK8234A" = "C:\WINDOWS\system32\D88olEDV7kS7kSu.exe"

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

I hope this guide helps you :)

Guard Online - Fake AV - removal guide - how to delete

2011-10-06T11:41:00.006+03:00

AV Guard Online - it is fake antivirus. Only money ransom.

Files are created:

C:\Documents and Settings\<UserName>\Application Data\F33rfbIK2AV Guard Online.ico (it's random name)
C:\Documents and Settings\<UserName>\Application Data\ldr.ini
C:\Documents and Settings\<UserName>\Desktop\AV Guard Online.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\1.tmp
C:\Documents and Settings\<UserName>\Start Menu\Programs\AV Guard Online\AV Guard Online.lnk
C:\WINDOWS\system32\vzRRFB8lEV.exe (it's random name)

Registry edit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TiikWSV7kWCuQ5h8234A" = "C:\WINDOWS\system32\vzRRFB8lEV.exe"
(Random key and file names)

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

Good Luck :)

Data Restore - Rogue Fake AV - removal guide

2011-10-05T16:06:00.006+03:00

Rogue Data Restore hides all files and folders, and brings all the shortcuts in a some folder.

So that would find anything on your computer to show hidden files and folders.
To do this, open My Computer. In the menu click Tools - Folder Options.

Click the tab View. Scroll to the "Show hidden files and folders", select this option and click OK.

Now you can see the files and folders that were hidden in a consequence of virus infection.

Now again run My Computer and type in the address bar website trojan-killer.net and press Enter.

On this site you will need to download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

Files created:
C:\Documents and Settings\<UserName>\Application Data\Microsoft\Internet Explorer\Quick Launch\Data Restore.lnk
C:\Documents and Settings\<UserName>\Desktop\Data Restore.lnk
C:\Documents and Settings\<UserName>\Local Settings\Temp\2.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\P1kAlMiG2Kb7Fz.exe.tmp
C:\Documents and Settings\<UserName>\Local Settings\Temp\P5tM1QBI6DSS92.exe.tmp
C:\Documents and Settings\<UserName>\Start Menu\Programs\Data Restore\Data Restore.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Data Restore\Uninstall Data Restore.lnk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
C:\Documents and Settings\All Users\Application Data\yiEXcwRdRpIp.exe

Registry key created:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"yiEXcwRdRpIp.exe"="C:\\Documents and Settings\\All Users\\Application Data\\yiEXcwRdRpIp.exe"

Data Recovery - How to remove Fake Antivirus

2011-10-04T14:56:00.005+03:00

Rogue Data Recovery hides all files and folders, and brings all the shortcuts in a some folder.

So that would find anything on your computer to show hidden files and folders.
To do this, open My Computer. In the menu click Tools - Folder Options.

Click the tab View. Scroll to the "Show hidden files and folders", select this option and click OK.

Now you can see the files and folders that were hidden in a consequence of virus infection.

Now again run My Computer and type in the address bar website trojan-killer.net and press Enter.

On this site you will need to download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look on your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.

How to define - a malicious program or not

2011-09-30T16:22:00.001+03:00

Download and install the System Explorer.
Run it and go to the tab Processes.
Select a suspicious process, click on it by right-click, on the shortcut menu select File Check - Virustotal.com as shown below.

File upload to Virustotal.com and opens a browser window with information about this file.

On this page you will see a list of antivirus software, and in front of their verdict on this file.
If the majority of antivirus programs define it as malicious, you can safely delete it.
Do not forget that to remove a trojan or other malicious programs must not only memory but also from the disk where it stores its own copy, and startup.

How to remove programs from startup

2011-09-30T15:52:00.001+03:00

Download and install the System Explorer.
Run the System Explorer and go to the second tab.
Try to change it so that displayed information about the startup as shown below.

In order to remove the program from startup, press the right mouse button, and click Delete Item.

Be careful when removing programs from startup. Do not remove the system and useful processes.

How to kill the process from memory

2011-09-30T15:20:00.003+03:00

The easiest method to remove malware from memory is to download and run Trojan-Killer.
This program is a file scanner. Excellent find and remove any malicious software once and forever.
Clean your computer from infection in the autorun in the registry and on disk.

Another way - use Task Manager. Not the best, but execute without downloading any software.
To do this, press the key combination [Ctrl + Alt + Delete] or [Cltr + Shift + Escape].
After that, should start the Task Manager.
Go to the tab Processes, in the list that opens, select the malicious process, click End Process or Delete key on your keyboard. On the message, click Yes.

I recommend to download and install the System Explorer.
This program is similar to Task Manager, but has many advantages and ease of use.
Firstly a list of processes easier to understand and have the opportunity to see the information about running processes, their location on the disk, and you can check out any process for viruses. Next I'll describe in more detail.

Install the System Explorer. Run it.

To remove the the process from memory, click on it right mouse button and click End Process.

But remember, you only remove it from memory, if it is a malicious file - it is registered in the startup and will start again when you restart the system.
Before removing the process you can check File Directory Explore - opens the folder where this file exists.
If you are sure that this is a malicious program, then delete it from the process, and then remove from the disk.

I recommend reading the following articles:
How to define - a malicious program or not.
How to remove programs from startup.

General information about viruses and trojans

2011-09-30T13:24:00.002+03:00

All malwares have common characteristics.
Firstly, they should leave a copy on your computer.
Secondly, they are added to Startup.
Thirdly, they are staying in the process and at first glance does not bother me. But we know that they are spying on you and send useful information to the owner of a virus or trojan. It could be passwords, numbers of credit cards, mail and more other things.

Here I will list the disk space where most malware leave their copy.
At the root of C:\ drive
In the system folders:
C:\Windows\
C:\Windows\System\
C:\Windows\System32\
C:\Windows\System32\drivers\
C:\Program Files\
C:\Documents and Settings\All Users\
C:\Documents and Settings\All Users\Application Data\
C:\Documents and Settings\<UserName>\Application Data\
C:\Documents and Settings\<UserName>\Local Settings\Application Data\
C:\Documents and Settings\<UserName>\Local Settings\Application Data\Temp\
C:\Documents and Settings\<UserName>\Local Settings\Temp\
C:\Documents and Settings\<UserName>\Local Settings\Temporary Internet Files\

They can also create shortcuts on the desktop, Start menu, Start menu - Programs, Start menu - Programs - Startup.

Next I will list how to add programs to autostart.
Some worms make a copy of your disk space and is an additional file autorun.inf in the root of all drives. It provides a malicious program to run in the opening drive. Autorun.inf file is responsible for the startup disk drives, not only the CD DVD, but the hard drive and flash drives. So if you find such a file in the root of any drive - delete it immediately.
The second way - it is adding a file or shortcut in the Start menu - Programs - Startup.
The third method, and the most popular - adding to the register.

Now I will list the registry key to viruses and Trojans that might be specified at boot time operating system be automatically run.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

These branches are the keys which is prescribed path to the program.
Does it look like this:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
lsssass = "%AppData%\Install\lsssass.exe"
Where lsssass - the key name which contains the path to the program.
%AppData% - a signature of hard disk space: C:\Documents and Settings\<UserName>\Local Settings\Application Data\

WARNING! Be careful editing the registry so as not to harm your computer. If you are not confident in your abilities, better ask the one who is more versed in operating systems.

Rogue Fake AV Data Recovery - how to detect and remove

2011-09-29T11:39:00.001+03:00

Step 1.
Kill the malicious process yiEXcwRdRpIp.exe

Step 2.
Delete the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\yiEXcwRdRpIp.exe

Step 3.
Delete next files on your system disk:

C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Data Recovery.lnk
C:\Documents and Settings\Admin\Desktop\Data Recovery.lnk
C:\Documents and Settings\Admin\Local Settings\Temp\2.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\P5tM1QBI6DSS92.exe.tmp
C:\Documents and Settings\Admin\Start Menu\Programs\Data Recovery\Data Recovery.lnk
C:\Documents and Settings\Admin\Start Menu\Programs\Data Recovery\Uninstall Data Recovery.lnk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
C:\Documents and Settings\All Users\Application Data\yiEXcwRdRpIp.exe

How to kill malicious processes

2011-09-28T15:43:00.005+03:00

Typically, antivirus and antimalware applications ( like Trojan-Killer ) kills malicious processes automatically once detected. That is a preferred way, as these tools know how to precisely recognize bad processes. However, under certain circumstances processes need killing before running scan:

You want to delete malware manually

Malware processes block removers from execution or updating their database

You can not download anti-malware tools

Malware tools do not have particular version of parasite in database yet and can not detect it.

It is important to know, that this important first step will stop symptoms for this reboot only, you will need to proceed with removal steps for completely cleaning the PC.

In case you fail to launch Spyware Doctor or any other program, first try rightclicking on them and running as administrator (on windows 7 or Vista).

Using safe mode

Most of malicious processes are inactive when PC operates in safe mode with networking. To reach safe mode with networking, do following:

Reboot
Press F8 early on (you can press F8 couple times)
Choose Safe mode with networking (preferably) or safe mode from menu
On success you should not see any alerts that bother you under normal mode continue to next steps of malware removal.

This will not work if malicious process is launched using drivers, master boot record or (in safe mode with networking) launched together with browser. Also, Safe mode might be disabled.

Killing processes using task manager

The benefit of using task manager is that you do not need to download anything. Task manager is present in all windows computers, though it might be disabled and provides little control

Open task manager by either pressing ctrl+shift+esc or pressing ctrl+alt+del and choosing from menu. For best results, try doing so just after windows login, while other processes are still loading
If it fails, go to go to Start->Run and type taskmgr
If this fails, go to C:\Windows\System32, copy taskmgr and rename it to 1.scr , 1.com or other random name. Launch that file. You can try right-clicking on it and choosing Run as administrator on Windows Vista or Windows 7
Choose process TAB, choose to see processes of all users (optional)
Choose malicious process from the list, right click on it
Press End process

On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.

Sometimes task manager is disabled by malware. A workaround would be to go to C:\Windows\System32, Make copy of taskmgr.exe and rename it to 1.exe or iexplore.exe . Launch the file.

Killing processes using process explorer

Process explorer provides more information on how the processes were launched. Also it is not blocked together with Task Manager. If it is blocked from execution, try saving it as 1.scr, 1.com or iexplore.exe before execution.

Download Process explorer from here : http://download.sysinternals.com/Files/ProcessExplorer.zip and unzip.
Launch process explorer (procexp.exe)
Select malicious process and press DEL.

On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.

Zentom System Guard - about this Fake AV

2011-09-28T14:08:00.012+03:00

Zentom System Guard fake Anti-Virus which requires money for registration. Otherwise it will bother you constant false messages.

Created files:

C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\enemies-names.txt

C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\finc70dkk.exe (or senrmodk70.exe)

C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\hookdll.dll

C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\local.ini

C:\Documents and Settings\<UserName>\Application Data\Microsoft\Internet Explorer\Quick Launch\Zentom System Guard.lnk

C:\Documents and Settings\<UserName>\Desktop\Zentom System Guard.lnk

C:\Documents and Settings\<UserName>\Start Menu\Programs\Startup\Zentom System Guard.lnk

C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard

C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard\Uninstall.lnk

C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard\Zentom System Guard.lnk

C:\Documents and Settings\<UserName>\Start Menu\Zentom System Guard.lnk

Register changes:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run "finc70dkk.exe" (or senrmodk70.exe)

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zentom System Guard
HKCU\Software\Zentom System Guard Inc\Zentom System Guard

To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.

Run and install it.

Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.

When the Trojan Killer will look up your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.