How to Remove Antivirus System PRO [Removal Guide]

Hi There
My Name is Fabio from NYC.
I got a damn Virus last night on my office computer and I went crazy.
I did a search on net for fixe it. but I download like 4 types or antivirus doctors. All of them felt. I went to craig list. and look for some IT in NYC but all of them scare or too expensive. I decite to take the computer to a store repair next door. they ask me $ 200.00 to fix it with out any guarantee.
So after all this frustration. I was about to give up.
I decide to do a little more search on net. than BAMM . Mister inferno/doctor
whatever you call. I decide to follow your steps to fixed it. I was already inpation.
But Man this is really good. Thank of you guys from this site and my percisstencee my computer runns like new now.
If anybody find Who put up this virus System Pro. I will give reward for that.
Doctor Inferno . Your name does not sound too good, But I think If I was God I would give you a penthouse on my condo.

Take care
Fabio NYC

Vinny The Guido - did you start Windows in Safe Mode with Networking BEFORE trying to download and then run the file? That is what I had to do, and that worked for me and someone else that also had this nasty program...

Hi Guys!
I had this bloody Anti virus system Pro in my lap top as couldn't open any webpage! It was a real nightmare!Then I just downloaded malwarebytes as it works very well! Just in few minutes I got rid of this horrible virus!
Thank you very much indeed.
Nico

How do I start the computer in safe mode ??? Thank you for responding by the way.

Hello,

Boot into Safe mode with networking by doing the following:

• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, keep tapping F8.
  
• Instead of Windows loading as normal, a menu should appear
  
• Select the option, to run Windows in Safe Mode with Networking.

UPDATE : After installing the latest version of malware bytes and doing a "quickscan" that lasted about an hour, I found 86 infected files, some in the registry, it would seem like after rebooting (by the way it took a long time for my desktop to load after the reboot but now its fine.) that my computer is virus free. Thanks a lot guys! I will use GeekPolice for all my computer troubles! Lets just hope I dont have to visit too often haha. Cheers!!!


Hi, as soon as I got this virus I instinctively ran MalwareBytes which I had installed previously due to another virus. I did a full scan then went to GEEKPOLICE to make sure that I was doing the right thing, my problem is that even though I did a full scan that lasted 2 hour(s), 2 minute(s), 11 second(s),that scanned thousands of objects, the Malware Bytes only found 11 infected objects and it only found them during the Extra and heuristics scan. It seems that upon terminating the infected files that my computer is working fine again, my only concern is "Why did it only find these infected files while performing the Extra and heuristics scan???" and is 11 infected files ok for what Antivirus Pro 2009 was, were there more than 11 infected???

These are the files that MalwareBytes found during the full scan

I:\Documents and Settings\minerva\local settings\temp\egchvjgw.exe
I:\Documents and Settings\minerva\local settings\temp\deskmlpu.exe
I:\Documents and Settings\minerva\local settings\temp\ehcrqpob.drv
I:\Documents and Settings\minerva\local settings\temp\epagyhle.exe
I:\Documents and Settings\minerva\local settings\temp\ea-good.exe
I:\Documents and Settings\minerva\local settings\temp\dknqpcjghcj.dll
I:\Documents and Settings\minerva\local settings\temp\dllsvr32.exe
I:\Documents and Settings\minerva\local settings\temp\dssc32.exe
I:\Documents and Settings\minerva\local settings\temp\dmxonk.exe
I:\Documents and Settings\minerva\local settings\temp\econf32.exe
I:\Documents and Settings\minerva\local settings\temp\dnlsvc


There were no registry values found like in your guide. Why not?

OH NO

Ah right before I posed this from my mac I got the Security Warning on my windows, "Application cannot be executed The file dwwin.exe is infected. Do you want to activate your antivirus software now?" And the stupid antivirus pro alert is back in the corner and seems as if I didnt get rid of the program at all. What should I do?! I followed all the steps and restarted but for some reason that did absolutely nothing. I think its because I have an old version of Malwarebytes from august of 08 and now I cant update it because im told there is is a firewall blockage. Ahh please help me!

Last edited by NickTorres on 22nd August 2009, 9:50 pm; edited 1 time in total (Reason for editing : Update on Situation)

I have one of the antivirus system pro and it's destroying my computer I downloaded and followed your instrutions and it wont let me run the spyware remover and my computer is being slow, I'm currently using FireFox and I cant remove internet exploer. Please help

I have the same issue. I followed the steps mentioned in the guide. While doble clicking on winlogon.exe file, the Antivirus System PRO is blocking the winlogon.exe file and getting a pop up security warning messagfe 'Application cannot be executed. the file winlogon.exe is infected. Do you want to activate your antivirus software now?'. I tried with quickly clicking the winlogon.exe file by chossing No on the above popup message. But no luck again it comes. Its really annoying. How can I get our of this problem.?

Im sorry but i am so confused.
What do i save it to and how do i extract it?

I am unable to open any program to run Malware protection, thank you in advance!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:03:39 PM, on 8/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\justinb\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\vlhfbf\jpfesysguard.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\Documents and Settings\justinb\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\justinb\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\dwwin.exe
C:\Documents and Settings\justinb\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\justinb\My Documents\Downloads\winlogon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://skccom.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.206.201.8 osawarepro.microsoft.com
O1 - Hosts: 91.206.201.8 osawarepro.com
O1 - Hosts: 91.206.201.8 www.osawarepro.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O2 - BHO: BHO - {F03C6151-5D0E-4675-9E4B-01910A278C1F} - C:\WINDOWS\system32\iehelper.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [system tool] C:\Program Files\vlhfbf\jpfesysguard.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\justinb\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [system tool] C:\Program Files\vlhfbf\jpfesysguard.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1230921A-10E7-44F9-A31F-DA7E811FB3A6} (Siebel Email Support for Microsoft Outlook and Lotus Notes) - http://siebprod/callcenter_enu/18372/applets/SiebelAx_OutBound_mail.cab
O16 - DPF: {1C1DE932-8D89-4C07-BF9C-D8627EDB4849} (Siebel High Interactivity Framework) - http://siebprod/callcenter_enu/18372/applets/SiebelAx_HI_Client.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231944986078
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231944955625
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} (Siebel Desktop Integration) - http://siebprod/callcenter_enu/18372/applets/SiebelAx_Desktop_Integration.cab
O16 - DPF: {B0073133-2D9B-4AC6-8AAC-6EB8E9343040} (CEMAClassLoaderCtl Object) - http://192.168.15.60/EMA.Utils/EMA.ClassLoader/EMA.CLASSLOADER/Release_With_NETFX/EMA.ClassLoader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = skccom.com
O17 - HKLM\Software\..\Telephony: DomainName = skccom.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{72643BD0-225F-4166-9F49-3B24DEF1CD40}: NameServer = 192.168.10.46,192.168.10.8
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = skccom.com
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10021 bytes

Thank you so much! Honestly, I just made this account so I could post thank you messages! From now on, if I'm not sure of a program, I will DEFINATLY come here! I'm surprised I've never heard of such a great site! Sites like these should be all over Google, Yahoo! Search, BING, AOL search, etc. I love you!!! This site must be the greatest I have ever seen. This program was well planned out, except for their timing. They would have a popup every minute, but what they didnt realize were the Windows Security Alert, the fake "attacks" on an IP port, and the Spyware popup would appear every 15 seconds or so, with about 5 seconds in between the three popups. But the pornography popups and the Viagra popups were just too much. I definatly needed a site like this, and fast. Dont want anyone in this house getting suspicious. They harrass you about things until you make up some weird excuse about it. I dont know how I would excuse this one. Viruses, Trojans, IP port attacks, Pornography popups, most people would automatically assume that I was watching pornography videos and downloaded a virus. Thanks to you I dont have to go through that awkwardness.
Thank you and keep up the good work!

It's gone.

Thank you.

Thank you.

Thank you.

Thank you.

Thank you.

YOU ARE THE BEST!!!

THANK YOU THANK YOU THANK YOU


but seriously...thanks...not sure of how i dl'd this virus or whatever it WAS...but after following the instructions in this thread...its GONE

I am a giant newb and just deleted the file the virus was stored on and emptyed my bin gaa no stupid porno sites are poping up and the stupid security warnings malware bityes wont help me get it HELP ME PLEASE!

Thank you, everything work correct now

going to try malwarebytes. thanks for your info. John

Just to say thank you,
I downloaded the Malwarebytes programme in safe mode, then done a scan in safe mode & one in normal mode & it removed this annoying programme, and my computer connnects to the internet alot quicker.

Thanks once again.

Madmick

Hello. I have had this virus for awhile and I'm afraid it's getting worse. Now it can log me off my own Windows account and I'm afraid all my stuff will be lost. I tried to download the newest Java thing but it won't let me open it. Which folder should I save the Java to if I were to download it again? Please help me, & thank you for your time.

Thank you, thank you so very much

Hello, I have the subject virus and I downloaded the Malwarebytes link in your tutorial and it gives me a "runtime error "0" " message. It says vbAccelerator SGridII II Control. Any idea why this software isn't working for me? Thank you for your help!

Hello Jenny1115, please read this over:

http://www.geekpolice.net/virus-spyware-malware-removal-f11/read-this-before-posting-t3821.htm

Once done, start a new topic and post a HijackThis log here:

http://www.geekpolice.net/virus-spyware-malware-removal-f11/

I can't read properly, I don't know that I should post in the proper forums. Sorry for my stupidity and ignorance.

b-girl13 wrote:

My computer will not let me connect to this website. I tried burning Malwarebytes to a dvd, but the infected computer would not recognize the program. I am not that great with computers. Is there something else I can try?

Try loading the set-up icons on a flash drive via a 'clean' computer. Then drag the icons onto the infected computer and go through the steps.

Thanks! Malwarebytes' Anti-Malware did the trick.

Just wanted to say thank you. This worked great for my computer and only took like 5-10 minutes; which is saying something because I'm so not tech savvy.

-Cari

I have the antivirus system pro virus and it will not allow me to download any anti-malware like the one posted on this forum. I also tried to remove it from my task manager processes but the processes that I am being told to remove by this forum are not there. What should I do???

Last edited by Swag83 on 23rd September 2009, 5:24 am; edited 1 time in total (Reason for editing : Makin sure my statement is correct...)

Swag83 wrote:

I have the antivirus system pro virus and it will not allow me to download any anti-malware like the one posted on this forum. I also tried to remove it from my task manager processes but the processes that I am being told to remove by this forum are not there. What should I do???

Hello,

Open a new topic here: http://www.geekpolice.net/virus-spyware-malware-removal-f11/

We will help you from there.

So i did everything. removed the selected files and but not all of them could be removed. i got a message that said they would be deleted when i rebooted. however, it's still on my computer. what do i do now?

taigan wrote:

So i did everything. removed the selected files and but not all of them could be removed. i got a message that said they would be deleted when i rebooted. however, it's still on my computer. what do i do now?

Hello,

Open a new topic here: http://www.geekpolice.net/virus-spyware-malware-removal-f11/

We will help you from there.

Is there a boot disk (liveCD) version of this software? My system is too damaged to use these instructions.

First, I must say I created an account on here just so I could express my thanks...

This Antivirus something or other crap came out of nowhere, and I had no idea how to get rid of it! As we all know, it was extremely annoying because it would block websites, constantly pop up reminders (that would lead you to a site to purchase their software)... just very bothersome. I came to this site, followed the very easy instructions and voila! Good as new. I am very satisfied, thank you sooooooooo much!!! It's totally gone!

Hello,

I was following the instructions to remove "Anitvirus system pro alert" and downloaded malware. I can't unzip the file to run it.
The anitvirus system pro "security warning" comes up and says the file is infected.

thank you

OMG thanx it really worked and fast. your a life saver and if it weren't for your tips i would still be stressing out over the annoying pop ups.

Greetings Dr. Inferno,

You are THE MAN! WOW!

My computer was infected with the Antivirus Pro 2010 program, and I found you guys on the net today. I followed your directions with the Anti Malware download, wa la, I killed that 'beeaaatttcccchhh'. Laughing. I know that comment is not children friendly, however, I am HYPE, so what the hell. Laughing.

Thanks for some GREAT CONSULTATION!

ONE!

Peace,
Tipitinas

You work miracles......and I'm thankful.

The AntiVirus Pro is gone.....WOW!!!!

Very appreciative....as you can see.

It didn't work for me either. I finally got Malwarebytes downloaded. When I try to scan, it just sits there.... I let it sit for about 10 hours last night. Then I closed it and rebooted. Now, the pop ups for Antivirus Pro were gone, but nothing would open. Nothing will open, there is still a little icon in the lower right corner on my task task bar that says Antivirus Pro will restart, and I get the infected messages when I try to open stuff

I tried to download the file but it woudn't let me.

I tried downloading it again this time it worked so I am very glad that you put this on the forum.

please help me.I downloaded the software to remove total security virus but at the end while i tried to scan.the window just closes without any action.

it didnt work for me. it kept on saying that its infected so it doesnt work. please help!

Update - Oct 2009, one of our workers picked this up and now it is blocking any .exe from running once it loads. if you need to run any program you have to be ready to execute it immediately after login so that it is in memory before the "Antivirus system pro" is activated!!! Has required several reboots to get the scanner installed and loaded so that it was running before the "bug" was active.
Scanner ID'd the following files:
C:\Windows\syssvc.exe
C:\Program files\etjwic\awsysysguard.exe

rerunning scan but thus far MAMB scanner has found and removed it! Good Job guys.
RB

rubyred88,
joebell123456789

Please read this over and click here to open a new topic.

re: Rbeaman
How did you run the Anti-Malware program before the "Antivirus system pro" is activated!!!
Thanks.

Rbeaman wrote:

Update - Oct 2009, one of our workers picked this up and now it is blocking any .exe from running once it loads. if you need to run any program you have to be ready to execute it immediately after login so that it is in memory before the "Antivirus system pro" is activated!!! Has required several reboots to get the scanner installed and loaded so that it was running before the "bug" was active.
Scanner ID'd the following files:
C:\Windows\syssvc.exe
C:\Program files\etjwic\awsysysguard.exe

rerunning scan but thus far MAMB scanner has found and removed it! Good Job guys.
RB

Thank you so much. I had the Antispyware thing pop up suddenly about an hour ago and now everything is back to normal.

Thankyou so much for the info on this site. I had a big prob today with this Anti virus system pro...I followed your instructions, and it worked like a dream...NO MORE anti virus. Thanks heaps, a newbie.

Wow I must be the only one that this won't work for, I have tried to run malwarebytes, spybot and Hijack this but the all come up with and error
"Windows cannot access the specified path or file, you may not have approptiate permission"
So what else can i do???
any suggestions

re: hemp22

No, you aren't the only one. I couldn't run the 'malwarebytes' program. I think the makers of the virus are mutating it to defend against anti-virus programs. On my XP machine, I was able to restore to a system-restore point that was created the day before I was attacked. I hadn't made any software or config changes in the past few days, so it was safe for me to do the restore. After the restore, the virus didn't run so I was able to run the malwarebytes program, which only found its own winlogin.exe program.

Note, someone wrote instructions on this forum to disable the restore feature. If I had done that, I'd probably still be fighting this virus.

Thanks wwward

I have tried the system restore but this little bugger has disabled that to,
it wont let it go back at all. I have tried everything to get rid of the darn thing.
I posted on the other thread to try and get some help so we shall see.

Thanks
Again

Geekpolice saved my Dell XPS from the waste pile Thanks guys/girls