Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Thursday, October 6, 2011

How to Remove AV Guard Online (Uninstall Guide)

Tell your friends:
AV Guard Online is a fake anti-virus program that displays annoying pop-up messages claiming that viruses, Trojans, and other malicious software have been found, and offering to sell you a worthless solution. You should really beware of fake anti-virus software. Celebrity gossip, rumors, stolen tapes, infected adult websites and similar stuff usually lead users to malicious websites. We were actually very happy because of a significant drop in fake antivirus distribution activity. The authorities had taken down two distinct scam networks, there were only a few rogue anti-virus incidents during the last few weeks in your organization. Unfortunately, it's far too early to celebrate because cyber crooks came back with some fresh ideas and new viruses. On the other hand, rootkits and other more sophisticated malware took the lead and I'm not really sure what is worse. I've see a lot of posts out there about AV Guard Online already but only a few of them were created solely to help you to remove AV Guard Online malware without actually asking you to pay for commercial anti-malware software. I'm going to pass on a few words of wisdom, and while this may read like another "how to remove/get rid of", I'll show you some tricks that can make removal procedure a lot easier. To remove AV Guard Online from your computer, please follow the removal instructions below.



Before we continue, let's have a look at some of the fake security alerts and pop-ups designed to scare you into thinking that your computer is infected by Trojans and similar stuff. The graphical users interface is rather professional, but you can still tell it's a fake anti-virus program because genuine security products usually do not flash like very one or two minutes and do not block Windows system utilities. AV Guard Online reports the same infections on every infected computer, six threats including Trojan.VBS.Qhost, Trojan-Downloaded.JS.Remora and some others.

Here's an interesting fake security alerts claiming that your computer is infected by Keylogger Zeus malware.
Warning! Infection found
Unwanted software (malware) or tracking cookies have been found during last scan. It is highly recommended to remove it from your computer.
Keylogger Zeus was detected and put in quarantine.
Keylogger Zeus is a very dangerous software used by criminals to steal personal data such as credit card information, access to banking accounts, passwords to social networks and e-mails.


Nice, isn't it. There are some regular misleading pop-ups too.
Warning!
The file "taskmgr.exe" is infected. Running of application is impossible.
Please activate your antivirus software.

Security Warning
There are critical system files on your computer that were modified by malicious software.
It may cause permanent data loss.
Click here to remove malicious software.


And here's the whole list of supposedly infected items.



AV Guard Online is good at hiding from anti-virus programs. You're going to need to do a few things to make the system usable again. We wrote three different removal guides: manual removal guide, manual activation and the regular one using free anti-malware software. It is also worth mentioning that AV Guard Online can not delete your files and steal your sensitive information unless it comes bundled with more sophisticated malware. Most of the time it doesn't so do not worry. Oh, and one more thing, do not reboot your computer multiple times letting the infection dig deeper and deeper. Just follow the removal instructions below and you should be able to remove AV Guard Online without any problems. As always, if you have any questions, please leave comments below or just email us. Good luck and be safe online!

http://deletemalware.blogspot.com

AV Guard Online removal instructions:

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.


Manual AV Guard Online removal guide:

1. Right-click on AV Guard Online icon and select Properties. Then select Shortcut tab.



The location of the malware is in the Target box.



2. In our case the malicious file was located in C:\Windows\System32 folder. Select the malicious file, rename it and change a file name extension.

Original file: TcS22bF3nGaQWKf.exe



Renamed file: TcS22bF3nGaQWKf.vir



3. Restart your computer. After a reboot, download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.


Manual activation and AV Guard Online removal:

1. Choose to remove threats and manually activate the rogue program. Enter one of the following codes to activate AV Guard Online.

9992665263
1148762586
1171249582
1186796371
1196121858
1225242171
1354156739
1579859198
1789847197
1835437232
1837663686
1961232582



2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.


Associated AV Guard Online files and registry values:

Files:

  • C:\WINDOWS\system32\[SET OF RANDOM CHARACTERS].exe
  • C:\Documents and Settings\[UserName]\Application Data\conhost.exe
  • C:\Documents and Settings\[UserName]\Application Data\csrss.exe
  • C:\Documents and Settings\[UserName]\Application Data\[SET OF RANDOM CHARACTERS].1B6
  • C:\Documents and Settings\[UserName]\Application Data\ldr.ini
  • C:\Documents and Settings\[UserName]\Application Data\zA0uvS2ib3m5Q6EAV Guard Online.ico
  • C:\Documents and Settings\[UserName]\Application Data\Microsoft\csrss.exe
  • C:\Documents and Settings\[UserName]\Desktop\AV Guard Online.lnk
  • C:\Documents and Settings\[UserName]\Local Settings\Temp\[SET OF RANDOM CHARACTERS].tmp
  • C:\Documents and Settings\[UserName]\Local Settings\Temp\[SET OF RANDOM CHARACTERS].tmp
  • C:\Documents and Settings\[UserName]\Start Menu\Programs\AV Guard Online\AV Guard Online.lnk

Registry values:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
Share this information with your friends:

9 comments:

Anonymous said...

All my items on my computer was deleted... everything is gone on my computer except for recycling bin. It was a blank screen with no programs, no nothing,.. what do i do? ..

Admin said...

Are you sure your files are gone? Rogue AVs may hide some files to make you think that your computer is infected.

Hit the key combination CTRL+R on your keyboard. In the Open: field, enter "cmd" and hit Enter or click OK.

At the command prompt, enter "attrib -h /s /d" and hit Enter. Now, you should see all your files and folders if they were hidden.

Casey said...

How can I be certain that AV Guard is in fact gone from my computer? I have followed your instructions as outlined above and when I run SUPERAntiSpyware it doesn't find anything but the .vir file is still in my C:\WINDOWS\SYSTEM32 folder. Is this expected? Forgive me but I am not a highly technical person. Thank you.

Anonymous said...

Weird, this hit me today as well. I rebooted in safe mode, and ran a full malware bytes scan. It deleted 1 virus, and I rebooted, and it was still there.

On Win 7, I am attempting to "rename the .exe to .vir" but... it doesn't seem to give you that option for Win 7. This is crippling my computer atm :(.

Anonymous said...

all the scans ive been using except for Spybot have been closing after they started scanning, i tried everything even looking for the registry files but i can't find this registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"

this is really getting annoying and even from safe mode i try scanning and it doesn't work, any other ideas would be helpul (btw i used the activation code as well and i still tried scanning to no avail)

Anonymous said...

Very good post and seems to work well. One hint for everyone. When you are starting your computer, this malware starts with most other programs and doesn't take full control of the user interface for a bit. Before it starts, you can open a command prompt (start->run, enter 'cmd' and click OK).

then, even it starts, you can get to your command prompt using alt-tab. the screen may be still grey'd out but you can still type in that window.

finally, in the command window type 'taskmgr' which will open your task manager. Go to the processes tab, you will see the process with the random characters and you can kill it.

this worked on windows XP for me.

Once you kill the process, the UI disapears but the cleaning instructions above should still be followed otherwise it will come back after reboot.

Anonymous said...

All I want to say is that the manual removal process is long but well worth the sense of accomplishment when you finally get it to scan and remove

Anonymous said...

these instructions were a big help! Thanks!

XxLimeLightKiraxX said...

This virus has blocked me off to Task Manager, control panel, Run, and all that stuff. My computer for some weird reason, will not let me go to Safe Mode, this was WAY before the virus. Anyways, it seems that the only choice I have is the activation key. Will putting the activation key harm my computer more or what will happen if I do?