Remove AV Security Suite [Removal Guide]

Can't thank you enough! Its gone! I'm happy! Dr. Inferno Rocks!

Not sure if im supposed to check all of the HKLM & HKCU files on the log. I tend to over think things so i apologize.
Here's my log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:03:41 PM, on 6/16/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Hijack This\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:1025
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Wvaceqicoxicak] rundll32.exe "C:\Documents and Settings\Guest\Local Settings\Application Data\crtrtl.dll",Startup
O4 - HKCU\..\Run: [Gxesamep] rundll32.exe "C:\Documents and Settings\Guest\Local Settings\Application Data\elodocayewiduce.dll",Startup
O4 - HKUS\S-1-5-21-1214440339-1993962763-839522115-501\..\Run: [Wvaceqicoxicak] rundll32.exe "C:\Documents and Settings\Guest\Local Settings\Application Data\crtrtl.dll",Startup (User '?')
O4 - HKUS\S-1-5-21-1214440339-1993962763-839522115-501\..\Run: [Gxesamep] rundll32.exe "C:\Documents and Settings\Guest\Local Settings\Application Data\elodocayewiduce.dll",Startup (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User '?')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP - Unknown owner - C:\Documents and Settings\Administrator\My Documents\Port_APPS\PortableApps\Kaspersky_Portable\Kaspersky_Portable\avp.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Desktop Manager 5.8.811.4345 (GoogleDesktopManager-110408-113106) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6487 bytes

I have problems at the first stage already. I think AV Security Suite may be blocking something. So I go into internet explorer tools, followed by connections tab and the LAN setting. I uncheck the box for using a proxy and press OK. After this no APPLY button appears. So if I press OK the proxy settings reappear.

Please help me.

Thank you for this guide! My computer is fixed! Thank you thank you thank you! =D

I hope you've tried this first, before landing on this site here: 2-viruses.com/remove-av-security-suite .. 'cause all that site is designed to do is further your plight by trying to get you to buy another program called Spyware Doctor which is just another ploy to get your credit card #.. Thanks to this here GeekPolice I was able to remove this viscious sales commercial with only one blip in my internet having gone blind, but 1 more reboot fixed that. Those f*** bastards that created AV Security Maleware need to get their nuts removed by rusted hacksaw blades.. It's just this kind of nonsense that gives computer nerds a bad name. Right on to the freeware that resolved this stupid ploy to lock up my pc and reach around to my already empty pocket book.. telemarketing sales must be down now that I see they musta employed some pissed off pimply faced, obeese eunuch to write up a program like this. And I brought it all to a halt in just 3 minutes.. less time than it took to write this.

Hey. This AV Security Suite just appeared on my computer yesterday, and I've been doing everything I can to stop it. It's been forcing open random pages in Firefox and Internet Explorer, and some of its pop-ups cannot be closed. I set both Internet Explorer and Firefox to "No Proxy", though AV Security Suite could still open up pages. I came to this site and downloaded Hijack This as fast as I could, but AV Security Suite kept telling me that it was a virus and could not be executed. Every time I clicked Hijack This, it began to load and opened up, but then would disappear. So I was forced to start my desktop computer in Safe Mode with Networking in order to open up Hijack This.
So, my status at the moment is basically:
I cannot open Hijack This in Normal Mode. I can in Safe Mode with Networking, but I'm not sure which boxes to check before deleting by clicking "FIX THIS". There are many HKCU and HKLM lines, but I'm not sure which ones are necessary and uninfected and which ones I should be deleting. They are preceded by R0, R1, and 04.
Some of the HKCUs and HKLMs look important; things unrelated to the infection, like opening applications such as AIM or ADOBE stuff. . .

What I'm wondering is: can I run Hijack This in Safe Mode with Networking, instead of Normal, and still combat the infection enough before getting Malwarebytes? And: precisely which HKCUs and HKLMs should be deleted?
(My computer is a Windows XP desktop, but right now I'm using my uninfected laptop). Any help on getting rid of this AV Security Suite would be very much appreciated.

nick off every box with a HKCU and HKLM and run the proceedure as it's supposed to be run under safe mode w/networking.. it's just that point blank. i did it and it's gone with no aftermath of problems. i think each of those boxes is a block of some kind of block from the av security virus not allowing anything but it to be opened, which is why you must click off each box and remove them.

Last edited by dielaughing2 on 21st June 2010, 2:03 am; edited 1 time in total (Reason for editing : grammer)

I've been trying to remove AV since 2 days ago. I came across this page and it seems this might work, but I have tried to download HijackThis in normal mode and in safe mode and it won't let me. It just says that the "550 CWD command fialed...permission denied." Is there something else I can try? Also, can I download HijackThis in safe mode because the normal mode is giving me a lot of problems.

I appreciate your help. Thanks!

man, not to be rude or anything, but did you even bother reading this thread some? The answers to all your questions and problems are already covered here you just have to read and try.. Safe Mode With Networking would be where you start, but before you do that do yourself a favor and read this entire thread! Especially read the instructions, download the two things in safe mode w/networking and don't leave out reading my posts 'cause I don't wanna hear you askin more questions that have already been asked and answered..

Last edited by dielaughing2 on 23rd June 2010, 8:18 am; edited 1 time in total (Reason for editing : more info to add)

This is probably going to sound like a stupid question, but I want to get this out of my computer without ruining everything. I wasn't able to do the part of the instructions about HijackThis, but I did the second part and it's running fine. However, I went into the registry to make sure and it looks like some of the files that in the manuel removal are supposed to be deleted. But only some of them are there, and some aren't. Should I delete them? I'm assuming that maybe they're what would have been deleted if I did HijackThis right.

This didnt work for me

Im trying to install HijackThis on the windows XP where this funny program is and the AV is blocking every freaking program that pop-ups.

Help?!

Bump

Read the entire thread for f*** sake! You will never get rid of it unless you actually read this whole thread and inform yourself .. know what Safe mode is?!!!!!!!!!!!!!!!!!!!!!!!!

https://2img.net/h/i156.photobucket.com/albums/t26/PaddedWalls/AVSecuritySuiteMalwarebytes.jpg
^^This is total BS! Why can't I post a pic out of my own photobucket??! Only a link.. c'mon.. that's just lame!

this is what you should end up lookin at once you've actually read through and followed the full instructions in this thread.

Last edited by dielaughing2 on 25th June 2010, 2:48 am; edited 2 times in total (Reason for editing : This is total BS! Why can't I post a pic out of my own photobucket??! Only a link.. c'mon.. that's just lame!)

I can't download HiJack this, unable too. I tried looking for other sites with it and still no use..
Im on safemode right now..

I downloaded Malware Bytes and I did quick scan and it found no infections, I did perform full scan and it did, and I removed the infected but still AV is still on my PC

I tried using combo fix and still no use. Whats wrong?!

Orbox,

Have a look at the pre-posting instructions link in my signature and post a topic in the malware removal forums. Someone will help you

I was able to download the HijackThis executable to my Desktop, but the virus/infection won't let me install the actual application. Suggestions?

i can't open anything besides firefox and this av security is still on my computer, i downloaded the malware thing and i can't open it av blocks it. please help

Hi!
This is my first post here.

I had a problem while following the istructions.
I Used a proxy server for my LAN.
I downloaded Hijack this and fixed this 2 things
O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
O4 – HKCU\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe

Everything was going OK, but Then I restarted my notebook and I pressed F8 many times... but nothing happened. Nothing at all.
My notebook then shifted to a black screen that says "Press F11 to restore" (in italian is "Premi F11 per ripristinare", I don't know if in English "restore" is the precise word).

Now every time my notebook starts it stops on this screen and there is nothing I can do to make windows XP start.
Is my notebook to burn now?
Any help?

worked great! only took a couple of minutes av is off my computer now!

I was trying to follow your instructions but after I unchecked use a proxy server, and then ok, Apply was not an option to click. Another idea?

I went to uncheck the LAN settings on IE and it checked it right back. I cannot do anything with it because of all the "infected" pop ups. any suggestions on what to do? I am so frustrated right now because I cannot do anything on my computer. I am trying to follow the instructions on a laptop to fix my PC, and well, I am ready to just scream... can someone help me please on getting this AV thing off my computer

Hello, gdoggluke, dmassinger, and luvz2play.

Welcome to GeekPolice.net.

• Read and follow the steps in this topic.
  
• Then, post a new topic containing those logs in this section.

Thanks!

I removed AV Security Suite Virus and it returned the next day. Removed AV Sec Suite Virus again using Malware both times. This time I did a full scan and found additional AV viruses in my registry. I'm hoping for the best.

Good luck All

If you need help, please follow my instructions on the post above.

I am really hijacked. I can use Firefox but can not change the LAN settings in Explorer.

When I get to the line "After that, download HijackThis from HERE and save it to your desktop." nothing happens.

What can I do?

Thank you!

Please follow the same instructions from post 37.

dmassinger wrote:

It will not let me download the HijackThis , Suggestions?

Please follow the same instructions from post 37.

I got this stupid Virus yesterday, Been working on it since. Followed these instructions (although I had to download HijackThis from somewhere else because the link wouldn't work.) and the first time I did the malwarebytes scan it showed viruses, but a family member was helping me and after we downloaded Malwarebytes and scanned (we did a full scan, without the instructions now, we thought we didn't need the instructions anymore ._.; and then the popup said "It couldn't remove everything, restart your PC?" we thought it meant that the virus was still there, so we clicked no. After that, we tried multiple things, and now im back again, following the directions. I did the quick scan, Gasp, Nothing there? I did the full scan, gasp, nothing there either! So I restart my PC, and I can go everywhere EXCEPT for Internet Explorer (im on Safe mode atm), because when I click on internet it says "Warning, this website (google) is potentially dangerous & stuff, and like buy our fake program or scan " and pretty much thats the virus, except its only on internet, where before I couldn't open ANYTHING because it said "this has a virus!" Sigh. Great, it wont even SHOW UP on the scan, and I still have it. How can I get rid of it on the internet too, I already did the proxy thing, its still unchecked but it still wont work. Safe mode is the only internet I can get, and I heard from a friend who works at a computer company that I cant go online in Safe Mode to places like myspace and stuff because ill spread the virus and I'll get banned. (I tried to log into myspace on safemode before & it just refreshed the homepage. Could it be im banned now?) I hate AV Security Suite, its messed up my computer, is now invisible to the scans, and has infected my Internet. Joy. :sad:

An alternative method i used.

I used Vista's windows restore in safe mode to its earliest point
then rebooted and downloaded malware bytes. ran it didn't find anything.
everything is unlocked and running ok

Thank you SO MUCH!

This was the first thing I tried and it worked like a charm, everything seems to be back to normal... But I'll certainly be keeping those two programs handy on my computer in case of anything else happening.
I was on youtube with my little brother and he clicked a side link before I could stop him and there we go, AV Security Suite had infected my computer.
But, all's well that ends well I suppose.

Thank you so much for your help!!!!! Your information fixed my computer! Thank you, Thank you!!!!!

Thanks SO MUCH, worked perfectly!!

Can't get past first step. When I try to change proxy settings it just resets. RKill won't execute, Task Manger ony stay up for a second.

Please help.


Thanks in advance.

Thank you so much

I'm trying it out now, fingers crossed!

Q. if this works how can I repay the debt?

Ralph.x

My goodness, it really worked. I've spent all day trying to sort this out?
I'm not working at the mo, so this means alot to me, if anyone can think of a way I can repay your kindness, please e-mail me. I might be able to afford a few pounds to a charity of something? or in some other way?

Old Ralph wrote:

Q. if this works how can I repay the debt?

Ralph.x

GeekPolice has a donation page, located here.

awesome guys, thanks, back to normal
will consider buying the full version

Just wanted to say "THANK YOU"
I was able to get the dreaded AV Security Suite off using your guide.
One thing that may assist others, if they find the AV coming back. I used a flash drive to load the software in safe mode. But before I installed the software I disconnected my cable internet. Not sure if that makes a difference but I could not get the no proxy settings in IE to hold unless I disconnected the internet.
Once that was done, I followed the instructions and good bye AV..
I will be using the full version.
Once again thank you.

ajwalkman wrote:

Can't get past first step. When I try to change proxy settings it just resets. RKill won't execute, Task Manger ony stay up for a second.

Please help.


Thanks in advance.

I had a similar issue. I was able to do a "normal" reboot then I opened RUN.

I had already had msconfig entered so I just hit enter, I was able to go to my safe mode that way. Once in the safe mode I made my proxy settings change. But again, I had the internet disconnected before any of this. For me it just kept going back to the AV proxy settings, while I had the internet connected. Even when in safe mode.

One other thing, the flash drive I used was loaded from a non infected computer.

How am I supposed to address all the Firefox options (necessary to download the fix)...when the AV security suite wont let Firefox start in the 1st place?

fuzzwadd wrote:

How am I supposed to address all the Firefox options (necessary to download the fix)...when the AV security suite wont let Firefox start in the 1st place?

Do you have access to another computer. Family, work or library. If you follow the instructions to the point of downloading the sites. Then save the sites to a flash drive. That drive can be used via a USB port.
From the Safe Mode. Upload the software from the flash drive.
Then follow the instructions from the admin.
Hope this helps.

I finally got rid of it a few days ago & now its back. I know what did it too, JAVA did.


It was updating, then my AVG said: WARNING: trojan is trying to be installed or something, and its cause of java, so I clicked "Remove as power user" & then pressed "Move to vault". Then BAM as soon as I click that "AV Security Suite". WHY DOES JAVA HAVE THIS!? Isn't it supposed to be like, safe or something? -.- just ran malwarebytes and it has 4 infections, imma restart my computer now. This better work this time, cause the first time, this didn't work -.-'

I ran hijack this and did not find the codes to delete. I downloaded Malwarebytes and ran it but still infected so when I tried to run another scan AV would not allow it to open. I'm on dailup which as you know is incredibility slow but AV is making everything even slower. I am dumb as dirt about all this stuff so I seriously need some HELP!

I'm on my husband's side of the computer which is so far allowing me to search.

Any help would be greatly appreciated.

i cant access to hijack
help?

yinny wrote:

i cant access to hijack
help?

I got this error message when I tried to access hijack 550 CWD command failed. "/GeekPolice/HijackThis/winlogon.exe": Permission denied.


So I just went straight to the download. Saved it to a flash drive then followed the rest of the instructions.

Hollister wrote:

I ran hijack this and did not find the codes to delete. I downloaded Malwarebytes and ran it but still infected so when I tried to run another scan AV would not allow it to open. I'm on dailup which as you know is incredibility slow but AV is making everything even slower. I am dumb as dirt about all this stuff so I seriously need some HELP!

I'm on my husband's side of the computer which is so far allowing me to search.

Any help would be greatly appreciated.

Did you update the Malwarebytes and run it from the safe mode?
Also, once in the safe mode, did you reset the proxy settings? Before running the Malwarebytes.

Hi Bob,

I did not understand how to do the first part for fixing this problem so I just directly downloaded the the Malwarebytes. Once I downloaded it it did not say Malwarebytes but Security Scammer Full [?] is that alright? I'm so confused...sorry.

Thanks for your response.