FakeAlert Trojan/Virus removal

Remove Windows 7 Fix malware

admin — Sun, 10 Jul 2011 14:24:52 +0000

Windows 7 Fix is a misleading program that pretends to be a legitimate and useful system repair software. It will detect hardware and registry errors, state that can improve the performance your computer. However, you should never believe in it, because this software can not detect or fix any system problems. This parasite is created with one purpose, to steal your money.

Windows 7 Fix is distributed via trojans. On first start, this malware registers itself in the registry Windows, to run automatically. Further, the program starts the process of scanning a machine whose result is the discovery of the set of serious system problems, e.g “Data Safety Problem. System integrity is at risk.”, “Registry Error – Critical Error.”, “Ram Temperature is 83 C. Optimization is required for normal operation.”, etc. Then as the scan is complete, you get a prompt to purchase its full version and fix the system. Most important, don`t pay for the bogus software! You should ignore all that Windows 7 Fix will show you.

While Windows 7 Fix is running, it will display a lot of fake alerts that warn about critical system errors, hardware failure, etc. Some of the alerts are:

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

What is more, Windows Repair will block the action to launch any executables. Instead it will generate the fake warning box:

Windows detected a hard drive problem.
A hard drive error occurred while starting the application

Just the false scan results, all of these warning are a fake and should be ignored.

Moreover, Windows 7 Fix will also hide all files and folders on your system drive and install a TDSS trojan. The trojan may redirect search results in Google, Yahoo, MSN, block an access to security websites and much more.

From the above, obviously, although all the actions taken by Windows 7 Fix might look legitimate but, in reality, the program is totally scam. Don’t trust it! Need as quickly as possible to check your computer and remove all found components of this malware. Please follow the removal instructions below to remove Windows 7 Fix malware for free.

Automatic removal instructions for Windows 7 Fix malware

1. Enable “Show hidden files and folders” option

1.1. Click Organize->”Folder and search options”->View tab.

1.2. Select “Show hidden files and folders” option, uncheck “Hide extensions for known file types” and uncheck “Hide protected operating files”. Click OK button to save it.

2. Rename the main executable of Windows 7 Fix to stop it from autorunning

2.1. Click Start, type in Search field the text below:

%AllUsersProfile%

Press Enter. It will open a contents of C:\ProgramData folder. If this folder is empty, please repeat the step 1.

2.2. Locate randomly named files (e.g. se6qSOdT83lVn.exe, BVKcPHxLQWl.exe) and rename them.

2.3. Reboot your computer.

3. Unhide all files and folders that has been hidden by Windows 7 Fix

3.1. Click Start, type in Search field

cmd

Press Enter. Command console “black window” opens.

3.2. Type

cd \

Press Enter.

3.3. Type

attrib -h /s /d

Press Enter. Close Command console.

3.4. If your desktop is empty, then to view the contents of your desktop you can use the following trick. Click Start, type in Search field:

%UserProfile%\desktop

Press Enter.

4. Remove Windows 7 Fix malware

4.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

4.2. Perform a full scan. The scan may take some time to finish,so please be patient.

4.3. Remove what it found and reboot your computer.

5. Remove TDSS trojan

5.1. Download combofix.

5.2. Close any open browsers. Double click on combofix.exe and follow the prompts.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Windows 7 Fix files and registry keys:

%UserProfile%\Desktop\Windows 7 Fix.lnk
%UserProfile%\Start Menu\Programs\Windows 7 Fix\
%UserProfile%\Start Menu\Programs\Windows 7 Fix\Windows 7 Fix.lnk
%UserProfile%\Start Menu\Programs\Windows 7 Fix\Uninstall Windows 7 Fix.lnk
%AllUsersProfile%\[RANDOM CHARACTERS]
%AllUsersProfile%\[RANDOM CHARACTERS].exe
%AllUsersProfile%\dfrg
%AllUsersProfile%\dfrgr
%AllUsersProfile%\[RANDOM CHARACTERS].dll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS].exe

Remove Personal Shield Pro malware

admin — Wed, 29 Jun 2011 05:38:52 +0000

Personal Shield Pro is a fake security tool which you should remove immediately because its unable to detect, and, of course, remove threats from the system. The purpose of this rogue is to scare you by using misleading methods such false scan results and and then convince you to purchase full version of the software.

Like other rogues, Personal Shield Pro malware is usually distributed with the help of trojans or through browser security holes. Once installed, this malware will be configured to run automatically every time, when computer loads. Next, Personal Shield Pro will start a scan of your computer for supposed spyware and malware and displays a list of the items found.

After that it will offer to delete the infected files, but to do so, you need to register the rogue antispyware software. For this you need to pay about 60 dollars. Doing this is not necessary since the scan results is a fake, so you can freely ignore them.

While Personal Shield Pro malware is running, it will bombard your PC with annoying popups and fake security warnings claiming that the system is infected with all sorts of malicious software. An example:

Warning! Virus invasion detected!
Found virus activity

Of course, all of these alerts, like false scan results, are a just another attempt to scare you into thinking your computer in danger. So, you can safety ignore them.

From the above, obviously, Personal Shield Pro is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this fake antivirus. To do this, use the instructions below to help you remove Personal Shield Pro malware from your computer for free.

Automatic removal instructions for Personal Shield Pro

1. Reboot your computer in Safe mode with networking.
1.1 Restart your computer. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. Instead of Windows loading as normal, a menu should appear.

1.2 Select “Safe mode with networking” and press Enter.

2. Remove Personal Shield Pro and associated malware.
2.1 Download Malwarebytes Anti-malware or SuperAntispyware.
2.2 Install it.
2.3 Perform a full scan. The scan may take some time to finish,so please be patient.
2.4 Remove what it found.
2.5 Reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Personal Shield Pro files and registry keys:

C:\Documents and Settings\All Users\Application Data\[RANDOM].exe (Windows XP)
C:\ProgramData\[RANDOM].exe (Windows Vista/7)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM].exe

Remove System Smart Security malware

admin — Tue, 14 Jun 2011 15:44:44 +0000

System Smart Security is a fake security program that states that your computer is infected with all sorts of malicious software and prompt to purchase its full version to clean your PC. Before doing so, you should know, the program is totally scam:
- promoted and distributed with the help of trojans, fake video codecs, malicious pop-ups or banners;
- used misleading methods such fake security warnings and false scan results to scare you into thinking your computer in danger.
Remember, this software can not to detect or remove any malicious software! Thus, do not trust anything that this malware will display you and remove System Smart Security as soon as possible.

On first run, System Smart Security performs several tasks:
- configures itself to run automatically every time you start Windows;
- changes Windows HOSTS file;
- creates numerous files that later, during the system, will be detected by the program as malware;
Once the installation is complete, System Smart Security will simulate a system scan and detect a lot of infected files, trojans, worms, and so on, that will not be fixed unless you first purchase the full version of the program. Of course this is not necessary, because the system scan is a fraud, which is required in order to trick you into thinking your computer is infected with many viruses and trojans.

While System Smart Security is running, it will display a wide variety of alerts, reminders and fake security messages, that states, your computer is infected and prompt you to buy its paid version. Some of the alerts are:

Warning! Identity theft attempt detected
Hidden connection IP: 128.154.26.11
Target: Microsoft Corporation keys

Warning
Warning! Virus detected

System warning
No real-time malware, spyware and virus protection was
found. Click here to activate.

System alert
System Smart Security has detected potentially harmful software in
your system. It is strongly recommended that you register
System Smart Security to remove all found threats immediately.

Of course, all of these alerts are fake, feel free to ignore all of them.

What is more, System Smart Security may block the Windows Task Manager, and the work of most antivirus and antispyware utilities, so that they will not even start.

From the above, obviously, System Smart Security is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this fake antivirus. To do this, use the instructions below to help you remove System Smart Security and any related malware from your computer for free.

Automatic removal instructions for System Smart Security

1.2 Select “Safe mode with networking” and press Enter.

2. Reset Internet Explorer proxy settings.
2.1 Run Internet Explorer.
2.2 Click Tools -> Internet Options.
2.3 Select Connections Tab and click to Lan Settings button.
2.4 Uncheck “Use a proxy server” box.
2.5 Click OK and click OK again.

3. Remove System Smart Security and associated malware.
3.1 Download Malwarebytes Anti-malware or SuperAntispyware.
3.2 Install it.
3.3 Perform a full scan. The scan may take some time to finish,so please be patient.
3.4 Remove what it found.
3.5 Reboot your computer.

4. Reset HOSTS file
4.1 Download OTM by OldTimer from here.
4.2 Run OTM, paste the following text in “Paste Instructions for Items to be Moved” box:
:Commands [resethosts]
4.3 Click the red Moveit! button. Close OTM.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated System Smart Security files and registry keys:

C:\Documents and Settings\All Users\Application Data\da2933\ISda2_1234.exe
%UserProfile%\Application Data\System Smart Security
%UserProfile%\Application Data\System Smart Security\cookies.sqlite
%UserProfile%\Desktop\System Smart Security.lnk
%UserProfile%\Start Menu\System Smart Security.lnk
%UserProfile%\Application Data\System Smart Security\System Smart Security.ini
%UserProfile%\Start Menu\Programs\System Smart Security.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\System Smart Security.lnk

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | System Smart Security

Remove Malware Protection

admin — Tue, 07 Jun 2011 13:24:17 +0000

Malware Protection is a fake security program that states that your computer is infected with all sorts of malicious software and prompt to purchase its full version to clean your PC. Before doing so, you should know, the program is totally scam:
- promoted and distributed with the help of trojans, fake video codecs, malicious pop-ups or banners;
- used misleading methods such fake security warnings and false scan results to scare you into thinking your computer in danger.
Remember, Malware Protection can not to detect or remove any malicious software! Thus, do not trust anything that this malware will display you and remove it as soon as possible.

On first start, Malware Protection will register itself in the Windows registry to run automatically every time you start Windows. Then, the rogue starts scanning the entire system. During the scan the program will detects a lot of trojans, worms and so on. The scan look like legitimate ones but everyone should keep in mind that this interface is just used to trick you into thinking that your computer in danger!

Once scan is done, the rogue will prompt you to pay a full version of the fake software to clean the system. Don’t be one of the victims! Remember, it is not able to scan, nor detect any infections on your PC. You should ignore the scan results and remove Malware Protection as soon as possible.

To further scare the user, while Malware Protection is running, it will display a lot of various fake security alerts and warnings. Some of the alerts are:

Malware Protection
External software tries to control variety of your system files. This may lead to breaking of some data in your system. Click here to protect remote access to your PC & delete these
programs.

“iexplore.exe” is infected with Trojan. This worm has tried to use “iexplore.exe” to connect to remove host and send your credit card information.

Malware Protection Firewall Alert
Malware Protection has prevent a program from accessing the Internet.

It hopes to force you to believe that your computer is infected. Of course, all of the security alerts are a fake and like false scan results should be ignored.

From the above, obviously, “Malware Protection” is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this fake malware removal software. To do this, use the instructions below to help you remove Malware Protection and any related malware from your computer for free.

Automatic removal instructions for Malware Protection

1. Reboot in Safe mode with networking
It is possible that Malware Protection will not allow you to run a malware removal software. If this is the case, then you will need to reboot your computer in Safe mode with networking.

1.1. Restart your computer. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. Instead of Windows loading as normal, a menu should appear.

2. Remove “Malware Protection” related files and registry keys

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Malware Protection related files and folders:

%AppData%\defender.exe
%UserProfile%\Start Menu\Malware Protection.lnk

Malware Protection related registry keys and values:

HKEY_CURRENT_USER\SOFTWARE\[random]
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Malware Protection

Remove Windows 7 Recovery malware

admin — Mon, 23 May 2011 12:16:01 +0000

Windows 7 Recovery is a malicious program that pretends to be a computer defragmenter and optimization software, but in reality it is totally scam. It will hijack browsers, block all programs from running, display numerous fake critical error alerts in order to trick you into thinking your computer in danger. It hopes that you will next purchase its full version to fix all the fake errors. Do not purchase it! That won’t help you.

Windows 7 Recovery is distributed via trojans. On first start, this malware registers itself in the registry Windows, to run automatically. Further, the program starts the process of scanning a machine whose result is the discovery of the set of serious system problems, e.g “Data Safety Problem. System integrity is at risk.”, “Registry Error – Critical Error.”, “Ram Temperature is 83 C. Optimization is required for normal operation.”, etc. Then as the scan is complete, you get a prompt to purchase its full version and fix the system. Most important, don`t pay for the bogus software! You should ignore all that the system repair software will show you.

Moreover, Windows 7 Recovery will display a lot of fake alerts that warn about critical system errors, hardware failure, etc. Some of the alerts are:

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

What is more, Windows 7 Recovery will block the action to launch any executables. Instead it will generate the fake warning box:

Windows detected a hard drive problem.
A hard drive error occurred while starting the application

Just the false scan results, all of these warning are a fake and should be ignored.

From the above, obviously, although all the actions taken by Windows 7 Recovery might look legitimate but, in reality, the program is totally scam. Don’t trust it! Need as quickly as possible to check your computer and remove all found components of this malware. Please follow the removal instructions below to remove Windows 7 Recovery malware for free.

Automatic removal instructions for Windows 7 Recovery malware in Safe mode

1. Reboot in Safe mode with networking
It is possible that Windows 7 Recovery malware will not allow you to run a malware removal software. If this is the case, then you will need to reboot your computer in Safe mode with networking.

1.1. Restart your computer. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. Instead of Windows loading as normal, a menu should appear.

1.2. Select “Safe mode with networking” and press Enter.

2. Remove Windows 7 Recovery malware

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

Automatic removal instructions for Windows 7 Recovery malware in Normal mode

1. Enable “Show hidden files and folders” option
Windows 7 Recovery hides files and folders on your system drive (disk C by default). To see all hidden files and folders you need to complete this step below.

1.1. Click Organize->”Folder and search options”->View tab. Select “Show hidden files and folders” option and click OK button.

2. Rename the main executable of Windows 7 Recovery

2.1. Click Start, type in Search field the text below:

%AllUsersProfile%

Press Enter. It will open a contents of C:\ProgramData folder.

2.2. Locate randomly named files (e.g. se6qSOdT83lVn.exe, BVKcPHxLQWl.exe) and rename them.

2.3. Reboot your computer.

2. Remove Windows 7 Recovery malware

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Windows 7 Recovery files and registry keys:

%UserProfile%\Desktop\Windows 7 Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows 7 Recovery\
%UserProfile%\Start Menu\Programs\Windows 7 Recovery\Windows 7 Recovery.lnk
%UserProfile%\Start Menu\Programs\Windows 7 Recovery\Uninstall Windows 7 Recovery.lnk
%AllUsersProfile%\[RANDOM CHARACTERS]
%AllUsersProfile%\[RANDOM CHARACTERS].exe
%AllUsersProfile%\dfrg
%AllUsersProfile%\dfrgr
%AllUsersProfile%\[RANDOM CHARACTERS].dll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS].exe

Remove Windows Attention Utility malware

admin — Fri, 13 May 2011 13:34:19 +0000

Windows Attention Utility is a fake antivirus tool from the same family of malware as Windows Supervision Center, Windows Oversight Center, Windows Expansion System, Windows Power Expansion, Windows Lowlevel Solution, Windows Support System, Windows Emergency System, Windows Efficiency Magnifier, etc. The rogue similarly to other malware, may enter onto your computer with the help of Microsoft Security Essentials Alert trojan. Remember, this software really look realistic and you might even think that Windows Attention Utility is related to Microsoft Windows, but you should never trust this fake antivirus! The program is designed to look legitimate, but it is neither able to detect, nor to remove any infections from the PC. WindowsAttentionUtility is a total scam!

On first start, Windows Attention Utility malware creates an entry named Shell in the HKCU \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon key of Windows registry, thus creating a possibility to start automatically every time you start Windows. Then, the malicious software will reboot your PC.

Once computer is loaded, you will see a WindowsAttentionUtility screen instead of your Windows desktop. It will suggest to perform a scan of your computer. During the scan the fake antivirus will detect numerous false infections. Once the scan is done, Windows Attention Utility will say that was able to clean the majority of infected files, but was not able to cure a few important Windows files and prompt you to purchase its full version to clean them. Of course, the results of the scan as well as the scan process is a fake, so you can freely ignore all that this malicious program gives you.

To further scare the user, Windows Attention Utility will block the Windows Task Manager and legitimate Windows application from running. Moreover, while this malware is running, it will display also a lot of various fake security alerts and warnings. Some of the fake alerts are:

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a seriuos possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press ‘OK’ to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

It hopes to force you to believe that your computer is infected. Of course, all of the security alerts are a fake and like false scan results should be ignored.

From the above, obviously, WindowsAttentionUtility is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this fake antivirus. To do this, use the instructions below to help you remove Windows Attention Utility and trojans that can infiltrate your computer with this malware.

Automatic removal instructions for Windows Attention Utility malware

1. When Windows is loaded and you see a Windows Attention Utility screen, Click OK button. Once a fake scan is done, click “Fix errors” button. Now you can close the rogue by clicking to “X” button at the top-right of Windows Attention Utility. After that your desktop will be available.

2.
a) For Windows XP/2000 users
Click Start, Run. Type in Open field the text below:

%APPDATA%

Press Enter. It will open a contents of “Application Data” folder.

b) For Windows Vista/7 users
Click Start, type in Search field the text below:

%APPDATA%

Press Enter. It will open a contents of “Roaming” folder.

3. Open Microsoft folder. Locate randomly named files (e.g. seqsodt.exe, seqsodt) and rename them.

4. Reboot your computer.

5. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

6. Perform a full scan. The scan may take some time to finish,so please be patient.

7. Remove what it found and reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Windows Attention Utility files and registry keys:

%AppData%\Microsoft\[RANDOM CHARACTERS].exe
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell = “%AppData%\Microsoft\[RANDOM CHARACTERS].exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe | Debugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe | Debugger

Remove PC Security Guardian malware

admin — Fri, 06 May 2011 13:13:38 +0000

PC Security Guardian is a fake security tool which you should remove immediately because its unable to detect, and, of course, remove threats from the system. The purpose of this rogue is to scare you by using misleading methods such false scan results and and then convince you to purchase full version of the software.

PC Security Guardian is distributed with the help of trojans. When this trojan is started, it will download and install the rogue onto your computer. On first run, PC Security Guardian performs several tasks:
- configures itself to run automatically every time you start Windows;
- changes Windows HOSTS file;
- creates numerous files that later, during the system, will be detected by the program as malware;
Once the installation is complete, PC Security Guardian will simulate a system scan and detect a lot of infected files, trojans, worms, and so on, that will not be fixed unless you first purchase the full version of the program. Of course this is not necessary, because the system scan is a fraud, which is required in order to trick you into thinking your computer is infected with many viruses and trojans.

While PC Security Guardian is running, it will display a wide variety of alerts, reminders and fake security messages, that states, your computer is infected and prompt you to buy its paid version. Some of the alerts are:

Warning! Identity theft attempt detected
Hidden connection IP: 128.154.26.11
Target: Microsoft Corporation keys

Warning
Warning! Virus detected

System warning
No real-time malware, spyware and virus protection was
found. Click here to activate.

System alert
PC Security Guardian has detected potentially harmful software in
your system. It is strongly recommended that you register
PC Security Guardian to remove all found threats immediately.

Of course, all of these alerts are fake, feel free to ignore all of them.

What is more, PC Security Guardian may block the Windows Task Manager, and the work of most antivirus and antispyware utilities, so that they will not even start.

From the above, obviously, PC Security Guardian is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this fake antivirus. To do this, use the instructions below to help you remove PC Security Guardian and any related malware from your computer for free.

Automatic removal instructions for PC Security Guardian

1.2 Select “Safe mode with networking” and press Enter.

3. Remove PC Security Guardian and associated malware.
3.1 Download Malwarebytes Anti-malware or SuperAntispyware.
3.2 Install it.
3.3 Perform a full scan. The scan may take some time to finish,so please be patient.
3.4 Remove what it found.
3.5 Reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated PC Security Guardian files and registry keys:

C:\Documents and Settings\All Users\Application Data\da2933\PSda2_2121.exe
%UserProfile%\Application Data\PC Security Guardian
%UserProfile%\Application Data\PC Security Guardian\cookies.sqlite
%UserProfile%\Desktop\PC Security Guardian.lnk
%UserProfile%\Start Menu\PC Security Guardian.lnk
%UserProfile%\Application Data\Internet Security Essentials\PC Security Guardian.ini
%UserProfile%\Start Menu\Programs\PC Security Guardian.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PC Security Guardian.lnk

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | PC Security Guardian

Remove Antivirus Center malware

admin — Tue, 03 May 2011 15:43:22 +0000

Antivirus Center is a fake security program that states that your computer is infected with all sorts of malicious software and prompt to purchase its full version to clean your PC. Before doing so, you should know, the program is totally scam:
- promoted and distributed with the help of trojans, fake video codecs, malicious pop-ups or banners;
- used misleading methods such fake security warnings and false scan results to scare you into thinking your computer in danger.
Remember, Antivirus Center can not to detect or remove any malicious software! Thus, do not trust anything that this malware will display you and remove it as soon as possible.

On first start, Antivirus Center registers itself in the Windows registry to run automatically every time you start Windows. Then, the rogue starts scanning the entire system. During the scan the program will detects a lot of trojans, worms and so on. Remember, the scan look like legitimate ones but everyone should keep in mind that this interface is just used to trick you into thinking that your computer in danger!

To further scare the user, while Antivirus Center is running, it will display a lot of various fake security alerts and warnings. Some of the alerts are:

Antivirus Center
External software tries to control variety of your system files. This may lead to breaking of some data in your system. Click here to protect remote access to your PC & delete these
programs.

“iexplore.exe” is infected with Trojan. This worm has tried to use “iexplore.exe” to connect to remove host and send your credit card information.

Antivirus Center Firewall Alert
Internet Defender has prevent a program from accessing the Internet.

It hopes to force you to believe that your computer is infected. Of course, all of the security alerts are a fake and like false scan results should be ignored.

From the above, obviously, Antivirus Center is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove the fake security tool. To do this, use the instructions below to help you remove Antivirus Center and trojans that can infiltrate your computer with this malware.

Automatic removal instructions for Antivirus Center

1. Reboot in Safe mode with networking
It is possible that Antivirus Center will not allow you to run a malware removal software. If this is the case, then you will need to reboot your computer in Safe mode with networking.

1.1. Restart your computer. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. Instead of Windows loading as normal, a menu should appear.

2. Remove Antivirus Center malware

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Antivirus Center related files and folders:

C:\Documents and Settings\All Users\Application Data\[RANDOM]\.avi
C:\Documents and Settings\All Users\Application Data\[RANDOM]\.ico
C:\Documents and Settings\All Users\Start Menu\Programs\[RANDOM]\.lnk
%AppData%\Microsoft\Internet Explorer\Quick Launch\Antivirus Center.lnk
%UserProfile%\Desktop\Antivirus Center.lnk
%UserProfile%\Start Menu\Programs\Startup\[RANDOM].lnk

Antivirus Center related registry keys and values:

HKEY_CLASSES_ROOT\CLSID\{[RANDOM]}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{[RANDOM]}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | [RANDOM]

Remove Windows Fix Disk or WindowsFixDisk malware

admin — Thu, 14 Apr 2011 16:03:09 +0000

Windows Fix Disk is a misleading program that pretends to be a legitimate and useful system repair software. It will detect hardware and registry errors, state that can improve the performance your computer. However, you should never believe in it! WindowsFixDisk can not detect and fix any system problems. This parasite is created with one purpose, to steal your money.

Windows Fix Disk is distributed via trojans. On first start, this malware registers itself in the registry Windows, to run automatically. Further, the program starts the process of scanning a machine whose result is the discovery of the set of serious system problems, e.g “Data Safety Problem. System integrity is at risk.”, “Registry Error – Critical Error.”, “Ram Temperature is 83 C. Optimization is required for normal operation.”, etc. Then as the scan is complete, you get a prompt to purchase its full version and fix the system. Most important, don`t pay for the bogus software! You should ignore all that WindowsFixDisk will show you.

Moreover, Windows Fix Disk will display a lot of fake alerts that warn about critical system errors, hardware failure, etc. Some of the alerts are:

Critical Error!
Windows was unable to save all the data for the file \System32\496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

What is more, WindowsFixDisk will block the action to launch any executables. Instead it will generate the fake warning box:

Windows detected a hard drive problem.
A hard drive error occurred while starting the application

Just the false scan results, all of these warning are a fake and should be ignored.

From the above, obviously, although all the actions taken by WindowsFixDisk might look legitimate but, in reality, the program is totally scam. Don’t trust it! Need as quickly as possible to check your computer and remove all found components of this malware. Please follow the removal instructions below to remove Windows Fix Disk malware for free.

Automatic removal instructions for Windows Fix Disk malware in Safe mode

1. Reboot in Safe mode with networking
It is possible that WindowsRepair malware will not allow you to run a malware removal software. If this is the case, then you will need to reboot your computer in Safe mode with networking.

1.1. Restart your computer. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. Instead of Windows loading as normal, a menu should appear.

1.2. Select “Safe mode with networking” and press Enter.

2. Remove Windows Fix Disk malware

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

Automatic removal instructions for Windows Fix Disk malware in Normal mode

1. Rename the main executable of Windows Fix Disk

1.1. For Windows XP/2000 users
Click Start, Run. Type in Open field the text below:

%AllUsersProfile%\Application Data

Press Enter. It will open a contents of C:\Documents and Settings\Users\Application Data folder.

1.1. For Windows Vista/7 users
Click Start, type in Search field the text below:

%AllUsersProfile%

Press Enter. It will open a contents of C:\ProgramData folder.

1.2. Locate randomly named files (e.g. se6qSOdT83lVn.exe, BVKcPHxLQWl.exe) and rename them.

1.3. Reboot your computer.

2. Remove Windows Fix Disk malware

2.1. Download Malwarebytes Anti-malware or SuperAntispyware and install it.

2.2. Perform a full scan. The scan may take some time to finish,so please be patient.

2.3. Remove what it found and reboot your computer.

If you need a help with the instructions, ask a question in the Spyware removal forum.

Associated Windows Fix Disk files and registry keys:

%UserProfile%\Desktop\Windows Fix Disk.lnk
%UserProfile%\Start Menu\Programs\Windows Fix Disk\
%UserProfile%\Start Menu\Programs\Windows Fix Disk\Windows Fix Disk.lnk
%UserProfile%\Start Menu\Programs\Windows Fix Disk\Uninstall Windows Fix Disk.lnk
%AllUsersProfile%\[RANDOM CHARACTERS]
%AllUsersProfile%\[RANDOM CHARACTERS].exe
%AllUsersProfile%\dfrg
%AllUsersProfile%\dfrgr
%AllUsersProfile%\[RANDOM CHARACTERS].dll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | [RANDOM CHARACTERS].exe

Remove XP Security 2011 malware

admin — Sun, 10 Apr 2011 12:52:42 +0000

XP Security 2011 is a new malicious program that hides under the guise of antispyware software. This malware is a clone of XP Antispyware 2011, that is a rogue too. The fake security program is distributed through trojans. When the trojan is started, it will install the fake security program on to your computer.

On first start, XP Security 2011 registers its main file in the Windows registry so, it will start automatically every time when you run any program that have .exe extension (most legitimate Windows programs). Then, the malicious software performs a fake scan and detects a lot of trojans, worms and viruses that actually do not exist on your computer.

After that, XP Security 2011 offers to buy its full version to remove any infection found. Doing this is not necessary since the scan results as well as the scan process is a fake, so you can freely ignore all that the rogue gives you.

To further scare the user, XP Security 2011 blocks legitimate Windows application from running. Moreover, while this malware is running, it will display a lot of various fake security alerts and warnings that states:

Stealth intrusion!
Infection detected in the background. Your computer is now
attacked by spyware and rogue software. Eliminate the
infection safety, perform a security scan and deletion now.

System hijack!
System security threat was detected. Viruses and/or spyware
may be damaging your system now. Prevent infection and
data loss or stealing by running a free security scan.

It hopes to force you to believe that your computer is infected. Of course, all of the security alerts are a fake and like false scan results should be ignored.

From the above, obviously, XP Security 2011 is a dangerous program, whose presence on your computer is absolutely undesirable. You need as quickly as possible to remove this malware. To do this, use the instructions below to help you remove XP Security 2011 and trojans that can infiltrate your computer with this malware.

Automatic removal instructions for XP Security 2011

1. Click Start -> Run. Type command and press Enter. It will open a command prompt window. Type into it notepad and press Enter. It will run a notepad. Type all the text below into Notepad.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe] [-HKEY_CURRENT_USER\Software\Classes\pezfile] [-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe] @="exefile" "Content Type"="application/x-msdownload"

Save this as fix.reg to your Desktop (remember to select Save as file type: All files in Notepad). Double Click fix.reg and click YES for confirm. Reboot your computer.

2. Download and install Malwarebytes Anti-malware or SuperAntispyware. Run and perform a full scan. The scan may take some time to finish,so please be patient. Let it remove what it found. Reboot afterwards (important).

Your computer should now be free of the XP Security 2011. If the instructions does not help you, then ask for help in the Spyware removal forum.

XP Security 2011 related files and folders:

%AppData%\[RANDOM].exe

XP Security 2011 related registry keys and values:

HKEY_CURRENT_USER\Software\Classes\.exe
HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\.exe\shell
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas
HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start
HKEY_CURRENT_USER\Software\Classes\.exe\shell\start\command
HKEY_CURRENT_USER\Software\Classes\pezfile
HKEY_CURRENT_USER\Software\Classes\pezfile\DefaultIcon
HKEY_CURRENT_USER\Software\Classes\pezfile\shell
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\runas\command
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\start
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\start\command
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | @ = “”%AppData%\[RANDOM].exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command | IsolatedCommand = “”%1″ %*”
HKEY_CURRENT_USER\Software\Classes\.exe | @ = “pezfile”
HKEY_CURRENT_USER\Software\Classes\.exe | Content Type = “application/x-msdownload”
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | @ = “”%AppData%\[RANDOM].exe” /START “%1″ %*”
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command | IsolatedCommand = “”%1″ %*”