Remove AV Security Suite [Removal Guide]

I'm trying it out now, fingers crossed!

Q. if this works how can I repay the debt?

Ralph.x

My goodness, it really worked. I've spent all day trying to sort this out?
I'm not working at the mo, so this means alot to me, if anyone can think of a way I can repay your kindness, please e-mail me. I might be able to afford a few pounds to a charity of something? or in some other way?

Old Ralph wrote:

Q. if this works how can I repay the debt?

Ralph.x

GeekPolice has a donation page, located here.

awesome guys, thanks, back to normal
will consider buying the full version

Just wanted to say "THANK YOU"
I was able to get the dreaded AV Security Suite off using your guide.
One thing that may assist others, if they find the AV coming back. I used a flash drive to load the software in safe mode. But before I installed the software I disconnected my cable internet. Not sure if that makes a difference but I could not get the no proxy settings in IE to hold unless I disconnected the internet.
Once that was done, I followed the instructions and good bye AV..
I will be using the full version.
Once again thank you.

ajwalkman wrote:

Can't get past first step. When I try to change proxy settings it just resets. RKill won't execute, Task Manger ony stay up for a second.

Please help.


Thanks in advance.

I had a similar issue. I was able to do a "normal" reboot then I opened RUN.

I had already had msconfig entered so I just hit enter, I was able to go to my safe mode that way. Once in the safe mode I made my proxy settings change. But again, I had the internet disconnected before any of this. For me it just kept going back to the AV proxy settings, while I had the internet connected. Even when in safe mode.

One other thing, the flash drive I used was loaded from a non infected computer.

How am I supposed to address all the Firefox options (necessary to download the fix)...when the AV security suite wont let Firefox start in the 1st place?

fuzzwadd wrote:

How am I supposed to address all the Firefox options (necessary to download the fix)...when the AV security suite wont let Firefox start in the 1st place?

Do you have access to another computer. Family, work or library. If you follow the instructions to the point of downloading the sites. Then save the sites to a flash drive. That drive can be used via a USB port.
From the Safe Mode. Upload the software from the flash drive.
Then follow the instructions from the admin.
Hope this helps.

I finally got rid of it a few days ago & now its back. I know what did it too, JAVA did.


It was updating, then my AVG said: WARNING: trojan is trying to be installed or something, and its cause of java, so I clicked "Remove as power user" & then pressed "Move to vault". Then BAM as soon as I click that "AV Security Suite". WHY DOES JAVA HAVE THIS!? Isn't it supposed to be like, safe or something? -.- just ran malwarebytes and it has 4 infections, imma restart my computer now. This better work this time, cause the first time, this didn't work -.-'

I ran hijack this and did not find the codes to delete. I downloaded Malwarebytes and ran it but still infected so when I tried to run another scan AV would not allow it to open. I'm on dailup which as you know is incredibility slow but AV is making everything even slower. I am dumb as dirt about all this stuff so I seriously need some HELP!

I'm on my husband's side of the computer which is so far allowing me to search.

Any help would be greatly appreciated.

i cant access to hijack
help?

yinny wrote:

i cant access to hijack
help?

I got this error message when I tried to access hijack 550 CWD command failed. "/GeekPolice/HijackThis/winlogon.exe": Permission denied.


So I just went straight to the download. Saved it to a flash drive then followed the rest of the instructions.

Hollister wrote:

I ran hijack this and did not find the codes to delete. I downloaded Malwarebytes and ran it but still infected so when I tried to run another scan AV would not allow it to open. I'm on dailup which as you know is incredibility slow but AV is making everything even slower. I am dumb as dirt about all this stuff so I seriously need some HELP!

I'm on my husband's side of the computer which is so far allowing me to search.

Any help would be greatly appreciated.

Did you update the Malwarebytes and run it from the safe mode?
Also, once in the safe mode, did you reset the proxy settings? Before running the Malwarebytes.

Hi Bob,

I did not understand how to do the first part for fixing this problem so I just directly downloaded the the Malwarebytes. Once I downloaded it it did not say Malwarebytes but Security Scammer Full [?] is that alright? I'm so confused...sorry.

Thanks for your response.

Hollister wrote:

Hi Bob,

I did not understand how to do the first part for fixing this problem so I just directly downloaded the the Malwarebytes. Once I downloaded it it did not say Malwarebytes but Security Scammer Full [?] is that alright? I'm so confused...sorry.

Thanks for your response.

Hello, first let me start by saying I am not a computer wizard. My main computer got the AV security suite on it and after 5 hours of fighting the darn thing I stumbled onto this site. So bear with me and I will try to assist you.

What I did was as follows.

I have a secondary computer that was/is not infected.
I bought a flash drive. (from Wal-Mart less then $10) The flash drive is connected to my non infected computer via a USB port.
Once I have my flash drive "located" (for me I went to computers, then it was the "F" drive.)
I downloaded the link above in the admins instructions. The one that is red and says "download here"
That download was saved to my non infected computer.
I also downloaded the "updates" link from this part of the admins post.

"If you are having problems with the updater, you can use this link to manually update Malwarebytes' Anti-Malware with the latest database. Make sure that Malwarebytes' Anti-Malware is closed before installing the update.

It is the words "this link"

Now that both downloads are on my non infected computer, I then located the files. For me I looked in the downloads for the date I downloaded the file names were
mbam-set up
mbam-rules.

I copied both files to my flash drive (F drive)

Once that was completed I went to my infected computer and did the following.

Shut off computer. Disconnect power from computer for at least 30 seconds. Remove connection to the internet.
Re start computer and I tapped the F8 key to gain access to the "safe mode"
One time I tried this and could not access safe mode, so I did a normal start (still leaving the internet disconnected)
From the main page of my computer, I located the RUN function. I believe you are running windows XP click on start then you should see the Run are to the lower right side of the pop up screen.

If you can not access the safe mode via F8. Try typing in msconfig.....now the AV software will pop up something about a infection.
That is fine. Simple re boot the computer. This time while the computer is still booting up. You must move quickly to enter the Run and the msconfig then hit enter. I think you have like 30 seconds before the AV pop up comes up and blocks you.

Ok now from the safe mode.

Access the admin panel. this is done by just clicking on the Admin.
Insert your flash drive into the USB port.
Open internet explorer and reset the proxy settings as the admin of this site explains.
Then access your flash drive via the Computer. Mine is called the F drive.
Load the set up file and run.
Then close that application
Then load the rules file.
Now open the malwarebytes program and run as the admin of this site explains.
For me I went ahead and ran it twice. Shutting the computer down between running it twice.
Once the above is completed. You should be able to exit the safe mode Admin setting. This is done by going to RUN and typing in msconfig again.
Now your computer should be virus free.
After your computer is re booted...again.... and you do not see any annoying pop ups...re check your Internet Explorer settings to make sure NO proxy setting has re appeared.
Then connect the internet.

Again, I am not a computer GURU...so I no doubt did some overkill to get rid of this virus...but after a long night of trying to remove the darn thing...I just wanted it off.

I hope this assist you.

Please end your malware advice.

Hollister, if you need help please do the following:

• Read and follow the steps in this topic.
• Then, post a new topic containing those logs in this section.

Jay, I'm very happy to report I have gotten rid of that worthless crap off of my computer...there ought to be a law.

After staying up all night worrying about and trying to figure out how to get rid of AV security suite I believe I'm due a nap!

Thanks to you all and best of luck to everyone trying heal their computer. If I can do it anyone can.

Cheers and I mean that.

Sandy

Hi I'm dying over here with this stupid fake antivirus thing!

I'm able to open firefox and download some files but I can't install any of them or execute them. of course not even OTL so i have no idea what to do

DragonMaster Jay wrote:

• Read and follow the steps in this topic.
• Then, post a new topic containing those logs in this section.

i tried executing otl i get 'windows security alert, app cannot be executed, otl.exe is infected', which is coming from the av security suite

^^ Ok. Just start a new topic explaining what you have done so far. We can go from there.

Excellent guide, I succesfully removed most of AV. I used Hijack to delete the two files, but when i used malwarebyte it only found 1 file, I scanned both basic and full but it only found 1 file. I can open all programs but there is still one of the AV processes when i look in taskmanager. Also chrome has stopped working, it will open but is unable to connect to any sites, it gives the webpage is not available message. I know its only chrome because i am using firefox on my computer now and it is working fine. I have know idea how to find this last AV file as hijack and malwarebyte don't show anything. Any help would be welcome. otherwise thanks, this guide was great and got everything working well.

Also off topic, but sweet picture, fallout games are awesome

This has worked perfectly. I don't know if I needed to install HiJack, but I didn't because for some reason the link wouldn't let me even though I am logged in. Anyway, downloaded the Malwarebytes and that cleaned the whole thing up. My NOD32 sucks then.
Anyway, thanks.

it doesnt let me download Hijackthis.. HELP? i get this message everytime i click on "HERE" 550 CWD command failed. "/GeekPolice/HijackThis/winlogon.exe": Permission denied

This helped me two times when I did'nt feel like taken alot of steps: Just google search malwarebytes. Download the free one. Scan your whole computer when the installations stop and you are done. I recommend this program hope this helps someone.

I've gone through the various posts and started applying the instructions, but I get this error when trying to install HijackThis from the link there:

550 CWD command failed. "/GeekPolice/HijackThis/winlogon.exe": Permission denied.

Any suggestions?

Thanks.

thankyou thankyou thankyou!!! i have no idea on how to fix computers and when i got this virus i was worrying, your tutorial worked perfectly!!! and was really easy to follow. nothing went wrong at all THANKS!!!

With this site, I was able to remove AV - thank you!
I downloaded HiJackThis successfully, but was unable to run it, due to our friendly AV virus which blocked it.
I saved the downloaded file to my flashdrive, restarted my computer in safe mode, and picked up the instructions from there.

Thank you so much for this easy-to-follow guide. You saved my little netbook from that really annoying infection! Worked like a charm, and my daughter agrees not to download any executable files until someone looks at it first.

I am trying to use the guide, which seems pretty straighforward, but I can't find this code in hijackThis:

O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
O4 – HKCU\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe


I wonder if AV Security Suite might have hidden elsewhere? Any thoughts?

Hi Tripenny,

Chances are those are just random gibberish generated by the infection. Are you looking for random.exe?

If you post in our Malware removal forum someone will help you.

Crush:

The code I copied in my prior post was the code I had found up the page in the instructions on removing the AV Security Suite with HijackThis.

I was looking for [random] and couldn't find it. Neither my HKLM or HKCU code lines that get pulled up when I run HijackThis have [random] in them.

I will try the other forum. Thank you.

I am trying to use the guide that is posted on the site, which seems pretty straighforward.

Howevber, when I run HijackThis, I can't find any code with [random] like the directions note should be present:

O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
O4 – HKCU\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe


I wonder if AV Security Suite might have hidden elsewhere? Any thoughts?

One other thought: I had tried to get into safe mode after hitting F8 pre-windows, but my system just sat there without opening in Safe.

I am able to pull up the internet at this point, but I keep getting redirects to nonsense search sites. And this is after a long stretch where pornographic/viagra sites seemed the only ones that would populate my URL.

Please explain things simply -- I am a computer knucklehead.

Thanks!

I'm sorry -- I thought this was the malware forum -- I had pulled it up and then when searching for AV Security help, I guess it came back here.

Actually, I was denied the opportunity to post on the Malware forum, so anyone who is willing to help out with the problem I indicate would be much appreciated . . .




I am trying to use the guide that is posted on the site, which seems pretty straighforward.

Howevber, when I run HijackThis, I can't find any code with [random] like the directions note should be present:

O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
O4 – HKCU\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe


I wonder if AV Security Suite might have hidden elsewhere? Any thoughts?

One other thought: I had tried to get into safe mode after hitting F8 pre-windows, but my system just sat there without opening in Safe.

I am able to pull up the internet at this point, but I keep getting redirects to nonsense search sites. And this is after a long stretch where pornographic/viagra sites seemed the only ones that would populate my URL.

Please explain things simply -- I am a computer knucklehead.

Thanks!

Hi Tripenny. What do you mean you were denied posting there?

It told me that I couldn't post on that page. Here's what came up when I tried to post a new topic:

Sorry, but only users granted special access can post topics in this forum.

Ok. PM Doctor Inferno, and tell him that, and he shall fix it.

well i got the lil bugger and i wasn't even surfin porn lol. so all i did was boot into safe mode and ran avg pro antivirus and ccleaner. that got it. dont know if this is an after effect or not but realplayer wont record any flash based video anymore. and when i tried to reinstall it, it said i needed to download it again. and when i did it wouldn't install. then i found a version that did install but it couldn't connect to the net. i tried to stream music thru it but it just wouldn't connect. this is the second virus i've had with a bad side effect after removal. i got the yahoo messenger virus that gave me error popups for every program on my pc as it was booting. i killed it some how but now i can't hear youtube or any flash based video or games. i tried reinstalling/updating the sound drivers and adobe flash player, but still no sound. here some links to this year's IM programs that are infected.

http://www.shvoong.com/internet-and-technologies/websites/1967714-yahoo-messenger-virus-macgyver/

http://www.dotcominfoway.com/blog/skype-virus-alert

http://windowslive.com/Connect/Post/621c5849-21e7-48f5-9a82-a429071b17a0

http://www.symantec.com/connect/blogs/new-yahoo-messenger-worm

the skype virus gave me the blue screen of death window with the :STOP: c000021a (Fatal System Error) error on my other laptop. thank god there was nothing important on the hd. i had F2 and set it to boot from cd instead of hdd so i could boot from the installation cd and then reinstall the OS which wiped the virus off. frickin virus writers! they all need to be packed into a rocket like sardines and shot into the sun. seriously.

Hey this worked and I didn't know what the heck I was doing U guys R freakin awesome!

Thank you so much!

It worked perfectly and the pc is running like nothing happened!

Superb!

Virus is blocking the downlaod of both Hijack This & MalwareBytes. Please advise