Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93116 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Fake / Rogue anti-virus programs


  • This topic is locked This topic is locked
1 reply to this topic

#1 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 06 May 2010 - 04:51 PM

Removing the Fake anti-virus programs
=============================================================================
Security Master, Security Tool, PCommander, Virus Protector, Antispyware Soft, VirusCatch, VirusBye,
OneClean, Clean Up, Spyware Cease, Digital Protection, Desktop Security 2010,
Security Central, Antivirus Suite, Antimalware Doctor, Your Protection, Antivirus XP, XP 2008, XP 2009, XP 2010,
your system is infected, Google Redirect,
etc.


Posted Image


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


How to remove the fake anti-virus


First we need to Restart your computer in Safe Mode.

» On Windows XP

Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.


>> Vista

Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. You need to press F8 before the Windows logo appears. If the Windows logo appears, you will need to try again by waiting until the Windows logon prompt appears, and then shutting down and restarting your computer.

On the Advanced Boot Options screen, use the arrow keys to highlight the safe mode option you want, and then press ENTER. For more information about options, see Advanced startup options (including safe mode).

Log on to your computer with a user account that has administrator rights.

When your computer is in safe mode, you'll see the words Safe Mode in the corners of the display. To exit safe mode, restart your computer and let Windows start normally.


>> Windows 7

Restart your computer in Safe Mode.

Using the F8 Method:

Restart your computer.
When the computer starts you will see your computer's hardware being listed. When you see this information start to gently tap the F8 key on your keyboard repeatedly until you are presented with the Windows 7 Advanced Boot Options and select the Safe Mode option you want.

Then press the enter key on your keyboard to boot into Windows 7 Safe Mode.
When Windows starts you will be at a typical logon screen. Logon to your computer and Windows 7 will enter Safe mode.


Next:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista / Windows 7 Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.




Now we're going to use the fake anti-virus program "Security Tool" as the example here: Yours maybe different


1. Look on your desktop for a shortcut to the fake anti-virus program "Security Tool". (Yours maybe different.)
DO NOT delete the shortcut yet.

2. Right Click on the shortcut: "Security Tool". (Yours maybe different.) and select Properties.
Look at the path. It will be something like C:\Documents and Settings\All Users\Application Data\87654321\87654321.exe

Or under every user name C:\Documents and Settings\(your user name)\Application Data\87654321\87654321.exe


3. Right Click on the folder 87654321 and select Delete.

4. Once you have deleted the folder, delete the shortcut on your desktop and empty the Trash.

Reboot the computer in Normal Mode.


If you still need help Start a new topic:

Start a Posted Image in Spyware / Malware / Virus Removal Forum

    Advertisements

Register to Remove


#2 LDTate

LDTate

    Grand Poobah

  • Root Admin
  • 57,211 posts

Posted 31 May 2010 - 01:49 PM

Updated

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users