How to Remove Antivirus Monitor (Uninstall Guide)

Don't Copy From This Blog...

Antivirus Monitor is a rogue anti-virus application that displays false alert messages and misleading pop-ups in order to trick you into paying for the removal of threats that never really existed on your machine. It tries to convince you that these threats are actually real and this fake AV will continue to send these annoying and intrusive alerts until a payment is made. Antivirus Monitor is distributed through malicious websites, spam messages and other usual ways but one of the key ways in which such fake anti-virus applications are distributed is through fake online scanners that are very authentic copy of legitimate screens in Windows operating systems. After the scan finishes, visitors are informed that their computers are infected with viruses and then it push visitors to install Antivirus Monitor to clean up the non-existent threats. As you can see, this rogue anti-virus program relies on pop-ups with false detections, forcing you to buy this bogus software to get rid of infections that aren't there. If you are reading this article then your computer is probably infected with this bogus security software. To remove Antivirus Monitor and related malware, please follow the steps in the guide below.



Antivirus Monitor is from the same family as AntiMalware GO and AntiVira Av. It pretends to scan your computer for malware and falsely reports finding numerous infections: BankerFox.A, BitTera.C, Sality.AN, DMD.Bancos and other threats. Furthermore, Antivirus Monitor changes LAN settings and configures your computer to use a proxy server that displays a fake security warning instead of requested website. The rogue program will also randomly open web pages containing explicit/adult content.



Antivirus Monitor displays various imitations of the Windows Security Alerts, tricking users into enabling and buying the rogue anti-virus program:



What is more, Antivirus Monitor will block other programs on your computer, including Task Manager, Registry editor and some other useful system tools. The rogue program may block other programs in safe mode too.



In such case, you should restart your computer in debug mode and use system restore. Antivirus Monitor will take you to softwaream.com or any other similar websites to purchase a license of this scareware. There are three versions of this fake AV: Antivirus Monitor Limited, Antivirus Monitor Plus and Antivirus Monitor full. Prices range from $49.95 to $69.95.



Antivirus Monitor is a complete scam. If you have already purchased it, please contact your credit card company and dispute the charges. Then follow the removal instructions below to remove this piece of malware from your computer. If you have any further questions, please leave a comment. If you have any additional information about Antivirus Monitor, let us know. Good luck and be safe online!

---

Antivirus Monitor removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.



3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Alternate Antivirus Monitor removal instructions (in Normal mode):

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:33445
O4 - HKCU\..\Run: [SET OF RANDOM CHARACTERS] %Temp%\[SET OF RANDOM CHARACTERS]\[SET OF RANDOM CHARACTERS].exe e.g. ewrn29afhp8zy.exe

Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

OR you can download Process Explorer and end Antivirus Monitor process:

• [SET OF RANDOM CHARACTERS].exe, e.g. ewrn29afhp8zy.exe

3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Associated Antivirus Monitor files and registry values:

Files:

• %Temp%\[SET OF RANDOM CHARACTERS]\
• %Temp%\[SET OF RANDOM CHARACTERS]\[SET OF RANDOM CHARACTERS].exe

%Temp% refers to:
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)

Registry values:

• HKEY_CURRENT_USER\Software\[SET OF RANDOM CHARACTERS]
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = '1'
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ''
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = 'http=127.0.0.1:33445'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.exe'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'

Share this information with other people:

Read More

How to Remove Android Rootcager (Uninstall Guide)

Don't Copy From This Blog...

Android.Rootcager is a Trojan horse that steals information from Android devices. It can take screenshots, gather IMEI and IMSI numbers and send them to remote servers, and install a DownloadProvidersManager Android Package which creates a backdoor to your Android device and downloads additional malware in the background. Cyber-criminals inject their malicious code into popular free apps and republishes in the official marketplace under different application and publisher names. If you think that you may have installed an application in question, check com.android.providers.downloadsmanager (DownloadManageService) in the “Running Services” activity available from the Application system settings of your phone. If you find this service running on your phone, please stop it and uninstall the DownloadProvidersManager Android Package.


Image source: symantec.com

---

Android.Rootcager removal instructions:

1. Tap on Settings and under Settings, tap on Applications.
2. Under Applications, tap on Running services.
3. To stop com.android.providers.downloadsmanager (DownloadManageService) service, just tap it. A dialog will come up. Tap Stop to close the service.
4. Then, go to Manage Applications. Select the com.android.providers.downloadsmanager (DownloadManageService) and click on the "Uninstall" button.

Read More

How to Remove AntiVirus AntiSpyware 2011 (Uninstall Guide)

Don't Copy From This Blog...

AntiVirus AntiSpyware 2011 is rogue anti-virus software that displays fake messages saying that your computer is infected by viruses, spyware and other types of malware. It utilizes false scan results, browser hijackings and other misleading methods in order to scare you into purchasing the program. It may report up to 300 infections on your computer during virus scan. Such type of misleading software provides the user with no protection whatsoever. In other words, it pretends to be a legitimate antivirus program but instead of actually protecting your computer against malicious software and Internet threats, AntiVirus AntiSpyware 2011 provides a false sense of security. This application is a complete scam. If you've got a computer infected by this rogue anti-virus program, you should follow the steps in the AntiVirus AntiSpyware 2011 removal guide below.



AntiVirus AntiSpyware 2011 is from the same family as AntiVirus System 2011.

AntiVirus AntiSpyware 2011 blocks virtually everything you try and run, including legitimate anti-malware tools. It displays fake and very annoying security alerts saying that your computer is infected with spyware, adware and worms that can steal your sensitive information and delete important files. That's not true. What is more, AntiVirus AntiSpyware 2011 displays a fake Windows Security Center and states that hackers are trying to steal your computer license key. That's complete nonsense too.





So what happens when you click the "Active" button? You actually get redirected to a fraudulent payment processing site where you can purchase the software. AntiVirus AntiSpyware 2011 related websites:

• antivirusantispyware2011.com
• antivirusantispyware2011ltd.com
• antivirusantispyware2011comp.com
• antivirusantispyware2011corp.com

AntiVirus AntiSpyware 2011 hijacks Internet Explorer and redirects you to either a fraudulent payment processing site or completely unrelated and malicious websites. This rogue application cannot be removed through add/remove programs. If you have already purchased this rogue program, please contact your credit card company and state that the program is a scam and that you would like to dispute the charge. To remove AntiVirus AntiSpyware 2011, please follow the steps in the guide below. If you have additional information regarding this computer infection, please leave a comment below. And if you've got any further questions about this malware, please don't hesitate to contact us. Good luck and be safe online!

---

AntiVirus AntiSpyware 2011 removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Alternate AntiVirus AntiSpyware 2011 removal instructions using HijackThis or Process Explorer (in Normal mode):

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:
O4 - HKCU\..\Run: [Security Manager] C:\Documents and Settings\[User Name]\Application Data\AntiVirus AntiSpyware 2011\securitymanager.exe
O4 - HKCU\..\Run: [AntiVirus System 2011] "C:\Documents and Settings\[User Name]\Application Data\AntiVirus AntiSpyware 2011\AntiVirus_System_2011.exe" /STARTUP
O4 - HKCU\..\Run: [2hdpwq51skqnz] C:\Documents and Settings\[User Name]\Desktop\AntiVirus_AntiSpyware_2011\AntiVirus AntiSpyware 2011\securityhelper.exe
Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

OR you can download Process Explorer and end AntiVirus AntiSpyware 2011 processes:

• AntiVirus_AntiSpyware_2011.exe
• securitymanager.exe
• securityhelper.exe

3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Associated AntiVirus AntiSpyware 2011 files and registry values:

Files:

In Windows XP:

• C:\Documents and Settings\[UserName]\Application Data\AntiVirus AntiSpyware 2011\
• C:\Documents and Settings\[UserName]\Application Data\AntiVirus AntiSpyware 2011\AntiVirus_AntiSpyware_2011.exe
• C:\Documents and Settings\[UserName]\Application Data\AntiVirus AntiSpyware 2011\securitymanager.exe
• C:\Documents and Settings\[UserName]\Application Data\AntiVirus AntiSpyware 2011\securityhelper.exe

In Windows Vista/7:

• C:\Users\[UserName]\AppData\Roaming\AntiVirus AntiSpyware 2011\
• C:\Users\[UserName]\AppData\Roaming\AntiVirus AntiSpyware 2011\AntiVirus_AntiSpyware_2011.exe
• C:\Users\[UserName]\AppData\Roaming\AntiVirus AntiSpyware 2011\securitymanager.exe
• C:\Users\[UserName]\AppData\Roaming\AntiVirus AntiSpyware 2011\securityhelper.exe

Registry values:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus AntiSpyware 2011
• HKEY_CURRENT_USER\Software\AntiVirus AntiSpyware 2011
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "2hdpwq51skqnz"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Manager"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "AntiVirus AntiSpyware 2011"

Share this information with other people:

Read More

How to Remove AntiMalware GO (Uninstall Guide)

Don't Copy From This Blog...

AntiMalware GO is a rogue anti-virus application that hijacks your computer, displays misleading security alerts and reports non-existent infections in an effort to frighten you into purchasing worthless security software. This rogue application offers a false sense of security because it can not protect your computer against any type of malware. AntiMalware GO reported more than 20 false malware related security threats (mostly spyware, trojans and adware) on our test machine. This rogue AV it is installed via annoying pop-up ads, fake online scanners and infected websites. It is possible to get this rogue security software by simply visiting a website, even a reputable one. If AntiMalware Go has infected your computer, you should remove it immediately. Thankfully, we've got the removal instructions to help you to remove AntiMalware GO and associated malware for free. Please follow the steps in the removal guide below.



AntiMalware GO is from the same family as AntiVira Av and Antivirus .NET. It changes LAN settings and configures your computer to use a proxy server that displays a fake security warning instead of requested website. The rogue program will also randomly open web pages containing explicit/adult content.



AntiMalware GO displays fake security alerts and blocks other applications on your computer. Below are some images of some of the fake alerts generated by AntiMalware GO.





The fake AV redirects users to rodyshop.com or any other similar websites to purchase a license of AntiMalware GO. As you can see, there are three versions of this scareware: AntiMalware GO Easy, AntiMalware GO Advantage and AntiMalware GO Mega. Prices range from $49.95 to $69.95.



AntiMalware GO is a complete scam. If you have already purchased it, please contact your credit card company and dispute the charges. Then follow the removal instructions below to remove this piece of malware from your computer. If you have any further questions or concerns, please leave a comment. If you have any additional information about AntiMalware GO, let us know. Good luck and be safe online!

---

AntiMalware GO removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Launch Internet Explorer. In Internet Explorer go to: Tools->Internet Options->Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK.



3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Alternate AntiMalware GO removal instructions (in Normal mode):

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:33820
O4 - HKCU\..\Run: [SET OF RANDOM CHARACTERS] %Temp%\[SET OF RANDOM CHARACTERS]\[SET OF RANDOM CHARACTERS].exe e.g. hdrwpsjf38shef.exe

Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

OR you may download Process Explorer and end AntiMalware GO process:

• [SET OF RANDOM CHARACTERS].exe, e.g. hdwlcbr28aks5eg.exe

3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.

---

Associated AntiMalware GO files and registry values:

Files:

• %Temp%\[SET OF RANDOM CHARACTERS]\
• %Temp%\[SET OF RANDOM CHARACTERS]\[SET OF RANDOM CHARACTERS].exe

%Temp% refers to:
C:\Documents and Settings\[UserName]\Local Settings\Temp (in Windows 2000/XP)
C:\Users\[UserName]\AppData\Local\Temp (in Windows Vista & Windows 7)

Registry values:

• HKEY_CURRENT_USER\Software\[SET OF RANDOM CHARACTERS]
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = '1'
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = '0'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ''
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = 'http=127.0.0.1:33820'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = '1'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '.exe'
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'

Share this information with other people:

Read More

How to Remove Internet Defender (Uninstall Guide)

Don't Copy From This Blog...

Internet Defender is a rogue security application that runs a system scan for viruses and reports false threats to frighten you into thinking your computer is infected with Trojans, viruses, spyware and other type of malware. The rogue program displays fake security warnings and annoying pop ups stating that your computer is being attacked from a remote machine or that additionally installed software can steal your passwords and other sensitive information. Internet Defender is a piece of malware designed to rip people off. The bad guys behind this rogue program hope that you will believe your computer is badly infected and pay for the full version of the software to clean your PC. Internet Defender impersonates the legitimate Microsoft anti-spyware program called Windows Defender. This rogue AV makes its way to the system with the help of fake online scanners and Trojan horses. It is obvious that Internet Defender 2011 is a complete scam. You shouldn’t install or purchase this scareware. And if you somehow ended up with this malware on your computer, please follow the steps in the removal guide below to remove Internet Defender from your computer for free.



Internet Defender is a clone of Security Defender. We wrote about it two weeks ago. The graphical user interface and self-defense mechanism hasn't changed much. The rogue program uses randomly names files and web browser hijacking to block legitimate security related websites and malware removal tools. Here are some of the fake security warnings it displays:

Internet Defender
Spyware.IEMonster process is found. The virus is going to send your passwords from Internet browser (Explorer, Mozilla Firefox, Outlook & others) to the third-parties. Click here for further protection of your data with Internet Defender.

Internet Defender Firewall Alert
Suspicious activity in your registry system space was detected. Rogue malware detected in your system. Data leaks and system damage are possible. Please use a deep scan option.

Although, it is possible to remove Internet Defender manually, we do not recommend doing so. First of all, it drops randomly named files into ApplicationData (Win XP) and ProgramData (Win Vista/7) folders. It could be rather difficult to identify and delete each malicious file from your computer. Secondly, Internet Defender can download additional malware onto your computer. That's why you should definitely scan your computer with anti-malware software. Last, but not least, if you have already purchased this phony security program, you should contact your credit card company and dispute the charges stating that Internet Defender 2011 is malicious software. If Internet Defender is installed on your computer, you should remove it immediately. Please follow the removal instructions below. If you have any questions or comments for us, please let us know. Good luck and be safe online!

---

Internet Defender removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key.


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove this rogue security program from your computer. Don't forget to update anti-malware software before scanning.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

---

Alternate Internet Defender removal instructions:

1. Download iexplore.exe (NOTE: iexplore.exe file is renamed HijackThis tool from TrendMicro).
Launch the iexplore.exe and click "Do a system scan only" button.
If you can't open iexplore.exe file then download explorer.scr and run it.

2. Search for such entry in the scan results (Windows XP):
O4 - HKLM\..\Run: [SET OF RANDOM CHARACTERS] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].avi", DllUnregisterServer
O4 - HKCU\..\Run: [SET OF RANDOM CHARACTERS] "C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].avi", DllUnregisterServer
O4 - Startup: [SET OF RANDOM CHARACTERS].lnk = C:\WINDOWS\system32\rundll32.exe

Select all similar entries and click once on the "Fix checked" button. Close HijackThis tool.

3. Download recommended anti-malware software (Spyware Doctor) and run a full system scan to remove this rogue security program from your computer. Don't forget to update anti-malware software before scanning.

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

---

Associated Internet Defender files and registry values:

Files:

Windows XP

• C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS]_.mkv
• C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].avi
• C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].ico
• C:\Program Files\Internet Defender
• C:\Program Files\Internet Defender\Internet Defender.dll
• C:\Documents and Settings\[UserName]\Local Settings\Temp\[SET OF RANDOM CHARACTERS].dll

Windows Vsita/7

• C:\ProgramData\[SET OF RANDOM CHARACTERS]_.mkv
• C:\ProgramData\[SET OF RANDOM CHARACTERS].avi
• C:\ProgramData\[SET OF RANDOM CHARACTERS].ico
• C:\Program Files\Internet Defender
• C:\Program Files\Internet Defender\Internet Defender.dll
• C:\Users\[UserName]\AppData\Local\Temp\[SET OF RANDOM CHARACTERS].dll

Registry values:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"

Share the knowledge:

Read More