Archive for the 'Rogue Antispyware/Antivirus' Category

What is Antivirus8, How to remove Antivirus 8

Friday, September 24th, 2010

Antivirus8 is a harmful program.

remove It is a fake security program, you should immediately remove it using an antivirus or antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Antivirus 8 associated files and folders:

%ProgramFiles%\AV8\
%ProgramFiles%\AV8\av8.exe
%UserProfile%\Desktop\Antivirus8.lnk
C:\Documents and Settings\All Users\Start Menu\AV8\
C:\Documents and Settings\All Users\Start Menu\AV8\Antivirus8.lnk
C:\Documents and Settings\All Users\Start Menu\AV8\Uninstall.lnk

Antivirus8 associated registry keys and values:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | AV8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | Debugger = “C:\Program Files\AV8\av8.exe -d”

Core filename: av8.exe
Command: %ProgramFiles%\AV8\av8.exe
HijackThis shows Antivirus8:

O4 – HKCU\..\Run: [AV8] C:\Program Files\AV8\av8.exe

Description: rogue antivirus program from the same family of malware as AntivirusGT

How to remove: use the Antivirus 8 removal guide here

What is av8 .exe, How to remove av8.exe

Friday, September 24th, 2010

av8.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: av8
Filename: av8.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | AV8

Command: %ProgramFiles%\AV8\av8.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [AV8] C:\Program Files\AV8\av8.exe

DDS Line:

uRun: [AV8] C:\Program Files\AV8\av8.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“AV8″=C:\Program Files\AV8\av8.exe

Description: core component of Antivirus8. Antivirus 8 is a rogue antivirus program.

How to remove: use the Antivirus8 removal instructions.

What is hotfix.exe, How to remove hotfix.exe

Wednesday, September 22nd, 2010

hotfix.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: hotfix
Filename: hotfix.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | “Shell” = “%UserProfile%\Application Data\hotfix.exe”

Command: %AppData%\hotfix.exe
Startup Type: HKCU->Winlogon->Shell
Description: core component of Microsoft Security Essentials FakeAlert trojan

How to remove: use the fake Microsoft Security Essentials Alert removal instructions.

What is Antivirus IS, How to remove AntivirusIS

Monday, September 20th, 2010

Antivirus IS (AntivirusIS) is a harmful program.

remove It is a fake security program, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Description: rogue antispyware program

How to remove: use the Antivirus IS (AntivirusIS) removal guide

What is IronDefender, How to remove IronDefender

Monday, September 13th, 2010

This is a harmful program.

remove It is a malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Files:

c:\Documents and Settings\All Users\Start Menu\Programs\IronDefender.lnk
%UserProfile%\Desktop\IronDefender.lnk
c:\Program Files\{RANDOM}
c:\Program Files\{RANDOM}\{RANDOM}.exe
c:\Program Files\{RANDOM}\Uninstall.exe
c:\WINDOWS\{RANDOM}.exe
c:\WINDOWS\{RANDOM}.bin
c:\WINDOWS\{RANDOM}.dll
c:\WINDOWS\{RANDOM}.cpl
c:\WINDOWS\system32\{RANDOM}.exe
c:\WINDOWS\system32\{RANDOM}.bin
c:\WINDOWS\system32\{RANDOM}.dll
c:\WINDOWS\system32\{RANDOM}.cpl

Registry keys/values:

HKEY_CURRENT_USER\Software\IronDefender
HKEY_LOCAL_MACHINE\SOFTWARE\IronDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IronDefender
HKEY_CURRENT_USER\Software | Install_Dir = “C:\Program Files\{RANDOM}”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | {RANDOM}.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | {RANDOM}.exe

Startup Type: HKLM->Run, HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKLM\..\Run: [{RANDOM}.exe] “C:\Program Files\{RANDOM}\{RANDOM}.exe” -min
O4 – HKCU\..\Run: [{RANDOM}.exe] C:\WINDOWS\system32\{RANDOM}.exe

Description: rogue antispyware program

How to remove: use the IronDefender removal instructions.

What is Malware Destructor 2011, How to remove Malware Destructor 2011

Friday, September 10th, 2010

Malware Destructor 2011 is a harmful program.

remove It is a rogue antispyware program that uses misleading tactics to trick you into purchasing its full version. You should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Command: %AppData%\{RANDOM}\KB5625711.exe
Description: rogue antispyware

How to remove: use the Malware Destructor 2011 removal instructions.

What is Win7 AV.exe, How to remove Win7 AV .exe

Saturday, September 4th, 2010

Win7 AV.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: Win7 AV
Filename: Win7 AV.exe
Command: %ProgramFiles%\Win7 AV\Win7 AV.exe
Description: core component of Win7 AV (rogue antispyware)

How to remove: use the Win7 AV removal instructions.

What is AWM.exe, How to remove AWM.exe

Thursday, September 2nd, 2010

AWM.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: AWM
Filename: AWM.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | awm

Command: %AppData%\AWM\AWM.exe
Startup Type:
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [awm] C:\Documents and Settings\username\Application Data\AWM\AWM.exe

DDS Line:

uRun: [awm] C:\Documents and Settings\username\Application Data\AWM\AWM.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“awm”=C:\Documents and Settings\username\Application Data\AWM\AWM.exe

Description: core component of AWM Antivirus

How to remove: use the AWM Antivirus removal guide or the steps below.

Download Malwarebytes Anti-malware. Install, perform a scan and let it remove what it found. Reboot afterwards (important).

What is mediafix70700en02.exe, How to remove mediafix70700en02.exe

Sunday, August 29th, 2010

mediafix70700en02.exe is a harmful program.

remove It is a component of malware or spyware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Name: mediafix70700en02
Filename: mediafix70700en02.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | mediafix70700en02.exe

Command: %AppData%\{RANDOM}\mediafix70700en02.exe
Startup Type: HKCU->Run
HijackThis Category: O4
HijackThis Line:

O4 – HKCU\..\Run: [mediafix70700en02.exe] C:\Documents and Settings\User\Application Data\CA196E3D0F2D18F19323483E318BCFD5\mediafix70700en02.exe

DDS Line:

uRun: [mediafix70700en02.exe] C:\Documents and Settings\User\Application Data\CA196E3D0F2D18F19323483E318BCFD5\mediafix70700en02.exe

Combofix/RSIT Line:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“mediafix70700en02.exe”=C:\Documents and Settings\User\Application Data\CA196E3D0F2D18F19323483E318BCFD5\mediafix70700en02.exe

Description: core component of Antimalware Doctor (rogue antispyware)

How to remove: use the Antimalware Doctor removal guide or the steps below.

1. Download HijackThis from here and save it to your desktop.

2. Run HijackThis. Main menu opens. Click to “Do a system scan only” button. After HijackThis completes the system scan, check the box to the left of the following items:

O4 – HKCU\..\Run: [mediafix70700en02.exe] C:\Documents and Settings\User\Application Data\CA196E3D0F2D18F19323483E318BCFD5\mediafix70700en02.exe

Please be very careful, do NOT check any other boxes! Next, click on Fix checked on the bottom left side of the HijackThis screen. Close HijackThis.

3. Download Malwarebytes Anti-malware. Install, perform a scan and let it remove what it found. Reboot afterwards (important).

What is Advanced Security Tool 2010, How to remove Advanced Security Tool 2010

Friday, August 27th, 2010

Advanced Security Tool 2010 is a malicious program.

remove It is a malware, you should immediately remove it using an antivirus and antispyware program.
If that does not help, then ask us for help in the Spyware removal forum.

Filename: asectool.exe
Registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
“AdvSecTool

Command: %UserProfile%\Application Data\asectool.exe
Startup Type: HKCU->Run
Description: rogue antivirus program

How to remove: use the Advanced Security Tool 2010 removal instructions