Remove Unusualsearchsystem.com (Uninstall Guide)

Don't Copy From This Blog...

Unusualsearchsystem.com is another ZeroAccess-related search engine, browser hijacker that may redirect you to misleading and very annoying adware websites instead of the correct web page. A series of redirects occur randomly when clicking on search results. You will notice that your computer is infected right away. Websites take longer time to load and at the bottom of your web browser it says unusualsearchsystem.com instead of the requested websites.



ZeroAccess rootkit passes web browser requests through a web server controlled by cyber crooks and if they find related keywords, they will display ads on your computer. You can fire up Task Manager and look for a process that has the following structure: numbers:numbers.exe, for example 1258543:36569.exe. That's a clear sign that your computer is infected. Unfortunately, you can't remove this virus manually. To remove ZeroAccess rootkit and to stop unusualsearchsystem.com redirects, please follow the removal instructions below. If you need help remove this virus, please leave a comment below. Good luck and be safe online!

---

Unusualsearchsystem.com removal instructions:

1. If you have a 32-bit Windows, please use ZeroAccess/Sirefef/MAX++ removal tool.

2. If you have a 64-bit Windows, please use TDSSKiller.

3. Finally, scan your computer with recommend anti-malware software to remove the leftovers of this virus from your computer.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: if you get the following Windows Security Alert, please click on Unblock button. This alert is caused by ZeroAccess rootkit.



Share this information with your friends:

Read More

Remove Swellsearchsystem.com (Uninstall Guide)

Don't Copy From This Blog...

Swellsearchsystem.com is a ZeroAccess-related search engine that may redirect your web browser to irrelevant websites and display annoying advertisements. There are two common symptoms associated with ZeroAccess infection: search results and websites take a longer time to load and at the bottom of your web browser it says swellsearchsystem.com instead of "Done" the website you are viewing. That means your request passes through another web servers controlled by cyber criminals.



To stop annoying swellsearchsystem.com redirects and remove ZeroAccess rootkit, pelase follow the removal instructions below. Good luck and be safe online!

---

Swellsearchsystem.com removal instructions:

1. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

2. If you have a 32-bit Windows, please use ZeroAccess/Sirefef/MAX++ Rootkit Removal Tool

3. If you have a 64-bit Windows, please follow this removal guide.

Share this information with your friends:

Read More

How to Remove Antivirus XP Hard Disk Repair (Uninstall Guide)

Don't Copy From This Blog...

If you've got a warning from a program called Antivirus XP Hard Disk Repair v9, saying that your computer was infected with Trojan.Agent.ARVP then I'm afraid your PC has contracted a new variant of Trojan.MBRlock ransomaware. Like all the previous versions, this virus rewrites the master boot record (MBR) and demands a ransom before the system is restored to its original condition. So, as you can tell this is not a regular "hijack the Desktop" type of infection where you can get around by opening Task Manager in some sneaky way. You cannot boot into Windows from this. Usually, you can debug ransomware and find the activation key or password to unlock your computer but if you are at this point it's not going to happen. This new version of Trojan.MBRlock gathers detailed hardware information and generates a unique HDDKey. Once you have your unique HDDKey you can complete the license activation form at http://www.antivirusharddiskrepair.ru. The password will be sent to your registered e-mail address within one business day. Cyber criminals are constantly placing new spins on old scams with the goal of you into thinking that a virus has compromised your data. You shouldn't pay for this bogus Antivirus XP Hard Disk Repair ransomware.

Here's what the Antivirus XP Hard Disk Repair v9 warning looks like:

Antivirus XP Hard Disk Repair v9
Your PC was infected with Trojan.Agent.ARVP. This is a computer virus created
especially to delete information from PCs of business competitors. Probably one
of your participated in this act, which was aimed to damage or even ruin your
company.
All exciting information was encoded with resistant crypto algorithm EAS-256
which is impossible to decode with common methods. Reinstalling the operating
system will lead to DELETION OF ALL INFORMATION irretrievably.
Our company specialists succeeded in identification of vulnerable places in the
working algorithm of Trojan.Agent.ARVP virus and uploaded to your PC the special
version of Antivirus XP HardDiskRepair v9 so that you could have a chance to
recover your files. Our program received important HDDKey, which is urgently
important for decoding of the disks.
To cure your PC and decode all your disks you have to purchase the license for
Antivirus Hard Disk Repair v9 antivirus product and send us your HDDKey though
the license registration form.
Decoding the password will apply AMAZON cloud technologies and vulnerabilities
in the crypto algorithm EAS-256.
We require from one to twenty four hours to decode the password from your disks.
The password will be sent to your E-mail address.
License activation: http://www.antivirusharddiskrepair.ru/04762/
If the web-site is not available try again in several hours.

Well, the most scariest part is probably the crypto algorithm EAS-256 used to encode your files. But don't worry. It doesn't encrypt your files. This was made to scare you into thinking that your computer is messed up. Hopefully, you can remove the Trojan.MBRlock manually or use the Trojan.MBRlock keygen to generate the password. The folks at DrWeb lab have created a free keygen mbrlock16keygen.exe.

You can also use their web unblocker http://vms.drweb.com/mbrlock16+keygen/

HDDKey: 01FC70011070FB07
Password: zz1



Manual Trojan.MBRlock removal guide: http://spywareremovalx.blogspot.com/2011/10/trojanmbrlock.html

Don't forget to run a full system scan with your anti-virus software, once the fake warning is gone!

---

Associated Antivirus XP Hard Disk Repair, Trojan.MBRlock files and registry values:

Files:

• %APPDATA%\temp_sys.exe

Registry values:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '\userinit.exe,%APPDATA%\temp_sys.exe'

Share this information with your friends:

Read More

Trojan.MBRlock, Внимание! Ваш компьютер заблокирован

Don't Copy From This Blog...

Trojan.MBRlock is a very disturbing piece of malicious code which infects the master boot record (MBR) and prevents Windows from starting. Known as ransomware, this virus demands to purchase a license from the cyber criminal to restore access. The key difference between this ransowmare and another notorious infection defined as Trojan.Winlock is that the Trojan.MBRlock loads up before Windows and prevents it from starting whereas the Trojan.Winlock infection allows Windows to run but blocks access once your operating system has fully loaded. If you have multiple operating systems installed on your machine, Trojan.MBRlock will block each of them.

Trojan.MBRlock is usually distributed through the use of fake adult websites but cyber criminals can potentially infect your computer through other means, or even trick you into downloading the malware. We all know that viruses and malicious software are nasty things that can do all sorts of damage to your machine. Any attempt to restore the MBR using standard MBR recovery tools may lead to data loss. Besides, re-installing Windows won't help either because it doesn't fix the MBR. Resetting system time won't help too. Both, the original MBR and the unlock code are usually encrypted.

In a typical Trojan.MBRlock ransomware scenario you'll get a message alerting that your were watching certain types of prohibited pornography. The message text may display in both English and Russian. However, I stumble upon Russian ransomware a lot more often then other examples of such malicious software. Here's an example of what the fake Trojan.MBRlock message looks like:

Внимание! Ваш ПК заблокирован за просмотр и распространение порнографии с участием несовершеннолетних, элементами насилия, зоофилии. Для разблокировки, Вам необходимо оплатить штраф в размере 500 рублей в любом терминале оплаты.
Выберите на экране терминала категорию "Электронные деньги", "Webmoney" и т.д.
Найдите эмблему платежной системы WebMoney.
Найдите номер R кошелька (12 цифр) - 079030161849
Внесите сумму 500 рублей. Внимание: учитывайте комиссию терминала.
По завершению оплаты, на выданном терминалом чеке оплаты, Вам будет выдан персональный код, после ввода которого, Ваш ПК будет автоматически разблокирован. Любые попытки разблокировки, без оплаты и ввода персонального кода, приведут к уничтожению операционной системы.

Very often Trojan.MBRlock infections share certain characteristics: phone numbers, short codes, WebMoney and cash-in points. There are numerous web pages where you can enter the phone number and the short code given by the Trojan.MBRlock ransomware to get the unlock code. There's a chance that security vendors have already tested this ransomware and debugged the unlock code. Here are some websites that will hopefully help you to unlock your computer:

• http://support.kaspersky.com/viruses/deblocker
• http://www.drweb.com/unlocker/index?lng=en
• http://virusinfo.info/deblocker/

We will keep this post updated with latest unlock codes as well. Updated: 12/20/2011

Phone numbers: 89067983134, 89653751844
Unlock code: 9786775


MTC number: 89162609465
Unlock code: n7856tbt*&^n

WebMoney: 079030161849
Unlock code: 00043176

Phone number: 86572225665
Unlock code: XerVam

You can leave a comment below or just email us and request the unlock code, however, we can't promise you that we will actually find it.

http://spywareremovalx.blogspot.com

---

To remove the Trojan.MBRlock ransowmare manually, you should use either Dr.Web® LiveCD/LiveUSB or Kaspersky Rescue Disk 10 CD/USB.

Dr.Web® LiveCD
Step-by-step Installation Guide in English
Как это работает? (По русски)

Dr.Web® LiveUSB
Step-by-step Installation Guide in English
Как это работает? (По русски)

Kaspersky Rescue Disk 10 CD/DVD
How to record Kaspersky Rescue Disk 10 to a CD/DVD and boot my computer from the disk?
Как записать Kaspersky Rescue Disk 10 на CD/DVD и загрузить с него компьютер?

Kaspersky Rescue Disk 10 USB
How to record Kaspersky Rescue Disk 10 to an USB device and boot my computer from it?
Как записать Kaspersky Rescue Disk 10 на USB-носитель и загрузить с него компьютер?

Both tools are completely free and very well documented, however, if you still can't figure out how to run Dr.Web® LiveCD or Kaspersky Rescue Disk 10 USB, please leave a comment below and we will do our best to guide you through the installation process. Good luck and be safe online!

A few more examples of Trojan.MBRlock ransomware:






Share this information with your friends:

Read More

How to Remove System Restore (Rogue Software)

Don't Copy From This Blog...

"System Restore" is a rogue Windows registry cleaner and HDD repair program that claims to fix common cause of Windows crashes and error messages (please see the image below). The name of this malicious software is truly misleading. As you probably know, there's a valuable and genuine Windows utility called System Restore. It solves major Windows problems and restores Windows system files while the fake one reports non-existent system errors and HDD failures. System Restore (fake) is from the same family as Data Recovery malware. If your computer is infected with System Restore malware, please refer to the following web page for specific removal instructions for this type of malicious software: http://spywareremovalx.blogspot.com/2011/09/how-to-remove-data-recovery-uninstall.html. You can read the rest of the write-up on that web page too. If you have problems removing System Restore, please leave a comment below. We will be more than happy to help you find the appropriate removal method. Good luck and be safe online!



Before continuing with the removal instructions, you can use cracked registration key and fake email to register the program. This will allow you to download and run any malware removal tool you like and restore hidden files and shortcuts.

any@email.com
1203978628012489708290478989147



http://spywareremovalx.blogspot.com


Share this information with other people:

Read More