Remove Antivir Solution Pro [Removal Guide]

This guide will give you easy instructions on how to uninstall or get rid Antivir Solution Pro for free.


What is Antivir Solution Pro? (Information)

Antivir Solution Pro is a fake security software which uses fraudulent strategies by displaying false or exaggerated security issues on your computer rather than any legitimate ones to coerce you into purchasing their software.

When Antivir Solution Pro is installed, it will display bogus warning messages that your computer is infected. Antivir Solution Pro uses the many misleading techniques to win your trust and make you actually believe your computer is compromised with viruses, spyware or trojans. It will then suggest that you purchase a copy of it to rid of the infections. The hoax is the fact that it's bogus antivirus database is totally incapable of performing any of the declared functions.

Antivir Solution Pro is from the same group of rogue security software as AV Security Suite and Antispyware Soft.

---

Follow these preparation instructions to continue:

Because Antivir Solution Pro sets your browser to use an invalid proxy, you will not be able to surf any websites.

If you are using Internet Explorer, click on the Tools menu and select Internet Options.

• Now click on the Connections tab and then the Lan Settings button.
  
• Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN.
  
• Click the OK button. Then press the Apply button and then the OK button. Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer.

If you are using Firefox, click on Tools and click the Advanced tab.

• Go to the Network tab and select Settings.
  
• Select No proxy and click the OK button and click OK again. Now that you have disabled the proxy server you will be able to browse the web again with Firefox.

After that, download HijackThis from HERE and save it to your desktop.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of the lines which look like this:
  
  O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
  O4 – HKCU\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
  
  
• Close all opened Windows
  
• Press "Fix Checked"
  
• Close Hijack This.
  

---

Now, time for the removal. You have to start computer in Safe Mode by doing the following:

• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, keep tapping F8.
  
• Instead of Windows loading as normal, a menu should appear.
  
• Select the option, to run Windows in Safe Mode with Networking.

1. Please download the official version of Malwarebytes' Anti-Malware.




2. Install Malwarebytes' Anti-Malware by double clicking on mbam-setup




3. Follow the prompts. Make sure that Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware are checked. Then click finish.




4. Malwarebytes' Anti-Malware will automatically update itself after the installation, click the OK button to close that box and you will now be at the main program Window as shown below.

If you are having problems with the updater, you can use this link to manually update Malwarebytes' Anti-Malware with the latest database. Make sure that Malwarebytes' Anti-Malware is closed before installing the update.


5. Close All opened Windows, Programs, File or Folders.


6. Make sure you are on the Scanner tab. Select Perform quick scan then click the Scan button as shown below.




7. Malwarebytes' Anti-Malware will now start scanning your computer for infected files as shown below.




8. When the scan is finished a message box will appear, click OK to continue.




9. Click Show Results.




10. You will now be presented with a screen showing you the malware infections like shown below. Yours may look different depending on the infection you have.


11. Click on Remove selected.




12. When removing the files, Malwarebytes' Anti-Malware may require you to restart the computer in order to do a complete removal. If it displays a message stating that it needs to restart, click Yes.




13. After that you can close the Malwarebytes' Anti-Malware window, your computer is now cleaned from the malware infection.


To protect and prevent your computer from experiencing future threats like this, we highly recommend purchasing the FULL version of Malwarebytes' Anti-Malware with real-time (live) protection from this link.

---

If you are still experiencing problems or difficulties following this guide or require any assistance removing this malware, please post your questions in our Virus, Spyware & Malware Removal forums for free help.

You have to be logged in to post questions. Registration is free. By registering you will be privileged to other resources and to ask questions.

Last edited by Doctor Inferno on 29th July 2010, 2:02 am; edited 7 times in total

THANK YOU SO MUCH!

This tutorial worked perfectly. I guess Safe Mode and HijackThis was the trick. Thanks again!

The programme will let me change the LAN settings but only for a few seconds before it reverts back and comes up with the generic virus message. Therefore i am not able to get close to downloading the software app needed. any suggestions?

Note, the other profiles on the computer seem to be fine, it was just the one that i was in at the time the initial virus message came up is effected

Thanks for help, this is driving me nuts

Hello Andy,

If you are still experiencing problems or difficulties following this guide or require any assistance removing this malware, please post your questions in our Virus, Spyware & Malware Removal forums for free help.

Oh my gosh! Thank you so much!!

After searching for like 2 days to a solution for this, I finally found your website, which actually provides a set of WORKING instructions to remove antvir solution pro. Thanks again man!

Follwing your system for removal can only get as far as Apply in the first section. The apply button seems to be greyed out and won't operate. Any help would be appreciated.
esum

My husband is trying to remove antivir solution pro from his laptop & is following your instructions which I'm accessing for him (as he can't connect to the internet).

After selecting

TOOLS
INTERNET OPTIONS
CONNECTIONS
LAN SETTINGS

and unchecking Proxy Server, he is unable after pressing OK to press APPLY, and therefore cannot go any further in the process.

Is he doing something wrong? is there another option?

Many thanks.

Thanks so much, Before finding this site, it took 5 hours with windows security essentials to do a full scan, but nothing happened, after finding this site, it took me about 40 mins to rid my mom's computer of the virus.

emcb wrote:

My husband is trying to remove antivir solution pro from his laptop & is following your instructions which I'm accessing for him (as he can't connect to the internet).

Is he doing something wrong? is there another option?

If he has more than one user profile/account on his computer, try logging in using a different account. This is how I fixed the problem last night.

Since my Administrator account was infected, I simply switched to a different profile. The separate account showed no signs of the virus and I was able to get online without any problems.

I then downloaded the Malware program and used it to remove the Antivir files. Afterwards, I rebooted and logged back in using my regular Administrator account.

It was only at this point that I needed to access the "Connections" menu and erase the false proxy settings. I also unchecked the Proxy tab in order to gain access to the internet.

@emcb~
I had the same issue; the caveat being, I only had one user account (admin), so i couldn't log into a secondary one. I did however, figure a way to fix things- i used another site's process to block out the antivir pro virus and restart the computer in safe mode; one I got through that though, I came back here to GeekPolice and followed the rest of their directions. I started out on another site.

BUT- i stopped using their instructions when i reached the paragraph titled: "How to remove Antivir Solution Pro manually" (it's the first section beneath the image of the antivir solution screen image).

From there, I used this page's directions starting with: "1. Please download the official version of Malwarebytes' Anti-Malware." & downloaded it, then completed the rest of GeekPolice's advice.
Worked like a charm~ not sure why we ran into the same issue, but the other site's help is pretty basic; I just finished up here with GeekPolice b/ it required a download, and the only place i trusted a download from is GeekPolice ( a lot of the other sites claiming they can do the removal if you download their stuff are just other malware/virus crap.

@GeekPolice~ & D. Inferno in particular- i could kiss you, lol. this is the third or fourth time you saved me- you rock. xoxo

SparrowSleepingFox wrote:

@GeekPolice~ & D. Inferno in particular- i could kiss you, lol. this is the third or fourth time you saved me- you rock. xoxo

LOL. Glad I could help.

None of your steps work. Mbam wont detect it and it still works in safe mode.

I can't update it either it gives me an error 732. I can;t manually do it either because your link doesn't work. SO I'm screwed?

HELP - I did exactly what you said. Downloaded program and transfered it to the infected computer. It found the malware virus and I selcted remove and restarted computer. Now it wil not come up. Error 92 no operating system found. I need help. greg.

4mygal,

Please post a thread here:
http://www.GeekPolice.net/operating-systems-f20/

and someone will help you
===

None of your steps work. Mbam wont detect it and it still works in safe mode.

I can't update it either it gives me an error 732. I can;t manually do it either because your link doesn't work. SO I'm screwed?

Please post a thread in our Malware Removal forums and someone will help you further

when i change the proxy settings as soon as i hit apply the error message pops up straight away and the proxy settings i had just changed had been reset. i managed to download the hijack this program after several attempts because somtimes it gives me around one second before the changes reset. but now i need to open the hijack this program but i cant becuse, i chnge the proxy settings, quickly open hijack this, it opens for less than a second, and then the error message comes up, the progam closes and the poxy settings are reset. please please please give me a solution. im begging you...

This was essentially the same problem we were talking about above- I was able to get around it by using two sets of instructions;

"Once you start your computer, you got a few seconds before Antivir Solution Pro loads and makes your PC trigger its executable. So once you reboot, you should quickly do the following:
- Click ‘Start’ menu and choose ‘Run’ there. Then, type ‘msconfig’ (without quotes) in the command line there. You should now see a system configuration GUI that has a couple of tabs.
- Please select ‘Startup’ tab. Under ‘Startup’, you must find the process being exploited by Antivir Solution Pro. As a rule, it is a process that has an Unknown publisher (it’s mentioned next to it in that window), ending in tssd. So on ‘Startup’ tab, try finding something with Unknown publisher or some suspicious process, possibly one that has tssd symbols in the end of it.
You should now untick this process (processes), save the changes and exit the ‘msconfig’ window. Windows OS will prompt you to restart the machine so go ahead and agree. After reboot, Antivir Solution Pro will not be launched because we had disabled it on the Startup list. It’s still inside your computer though so you need to remove all of its files, each one of them otherwise the malware will find a way to keep destroying your PC. This is why please follow the instructions listed below for Antivir Solution Pro complete removal.
Also, in case your Internet connection has been disabled by Antivir Solution Pro malware, please do the following to restore it. Open Internet Explorer, go to ‘Tools’, click ‘Internet Options’, then ‘Connections’, ‘Lan settings’. Now, if the ‘Use a proxy server for your LAN’ option is selected, go ahead and unselect it. Or you can choose the ‘Automatically detect settings’ option. Save the changes and restart Internet Explorer – you should be back online now."

Once i finished that portion, i came back to this page, and started with the Hijack download, and completed the GeekPolice protocol.
If you've already managed to download the Hijack program, though, you should be able to use even if the antivir pro is sending out annoying pop ups~ but since you're using a program you've already installed and not going online, they won't be a problem for this portion - just move the Antivir boxes to the side as they come up and ignore them while you do the scan ("system scan only", and then check off the boxes as they list above. If you can't find the icon on your desktop for Hijack, then go to your start menu, and look for it under programs, right click on it and select open.
Once you finish the Hijack portion (scan and the checking of the boxes as directed above), you're going to shut your computer down, and restart it- when you restart it, you'll be hitting that F8 key (you have to hit it as soon as it starts back up, as they say above)- that will put your computer into safe mode, and it will keep the antivir from creating pop ups while you go online to download the Malwarebytes-
From there you shouldn't have any problems finishing up the GeekPolice steps. Hope this helps.

I was successful with these instructions, but with a couple of modifications:

* The current antivir jiggles the proxy settings in Internet Explorer in real time, so as several people said, you can't get back on the internet by disabling the proxy. I found that Firefox does work, though, and proceeded from there.

* After completing the scan and removal (thank you, masked man), I couldn't get IE back on the web (Firefox OK) until I went and disabled the proxy setting once again. From there, everything seems fine. At last.

Glad I found the solution here. As others have said, most of the 'remove ASP' sites are themselves ransom-ware bullshit. Yes, we'll detect your problem, but we won't fix it until you send us money. Aarggh!

Cheers, all

Hi
I had to do all this from another comp.
I wasn't able to connect to the comp on infected computer. I'm not all that certain if this worked.

I restarted my comp and logged in with safe mode.
I chose admin instead of my normal user.
From there I went to a "restore point"

So far I have been able to use my comp without antivir popups or it stopping my comp from any activities.

So what I'm trying to ask is was this a useful method when internet use wasn't quite possible on one comp?

Or am I just going to be haunted by antivir again?

I got the idea from the instructions here, on the other comp I couldnt apply changes to the proxy. Or download the HiJack program.

So what I did was basically just trying something I didnt expect to work.

Thanks a bunch I wouldn't have gotten the idea if not for this site.

Sorry if this doesnt make much sense.

Thank you so much Doctor Inferno. I have no idea how I acquired this shit, I usually turn my computer on as soon as I wake up and then keep it on as I go do other things throughout the day. I went out to go do something and then came back, watched some TV and noticed I had that antivir on my computer. I remembered hearing something fishy about it somewhere but I didn't know what to do as it locks your internet, so I used a library computer and followed your guide to rid my computer of all its nastyness.

I'm going to college soon and have everything on my computer including all my credit card statements and proof of what I've bought, only the small stuff like text files backed up. Believe me, I'm going to backup everything from now on and I'm going to keep my computer secure and on lockdown. Thank you so much again for this guide, saved me endless hours of worry.

Thanks chaps, worked for me to!
Only thing is my antivirus is still picking up the malware but doing nothing about it... I have Sophos Anti Virus, any recommendations on another product???

c4orce wrote:

Thanks chaps, worked for me to!
Only thing is my antivirus is still picking up the malware but doing nothing about it... I have Sophos Anti Virus, any recommendations on another product???

The full version of Malwarebytes Anti-Malware with real time (live) protection will prevent you from being infected with these kind of infections in future.

Note that this won't replace your current antivirus software, so you should use it as an extra layer of security instead.

I wish this would work but it doesn't for me.

When I did the "do a system scan only" on safe mode
O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
doesn't show up for me.

When I even tried to open HijackThis on the infected pc not running safe mode it wont even open. Well it opens and it shuts it.

I don't know what to do. Any help please?

ae86 wrote:

I wish this would work but it doesn't for me.

When I did the "do a system scan only" on safe mode
O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
doesn't show up for me.

When I even tried to open HijackThis on the infected pc not running safe mode it wont even open. Well it opens and it shuts it.

I don't know what to do. Any help please?

I have the same problem with random.exe not showing up in hijackthis. Also I ran multiple scans in safe mode with the full version of anti malware. Now anti-malware shows to be blocking some websites and i still dont have access to internet through IE. The proxy settings all are unchecked.

voltik wrote:

ae86 wrote:

I wish this would work but it doesn't for me.

When I did the "do a system scan only" on safe mode
O4 – HKLM\..\Run: [random] c:\documents and settings\user\local settings\application data\random\random.exe
doesn't show up for me.

When I even tried to open HijackThis on the infected pc not running safe mode it wont even open. Well it opens and it shuts it.

I don't know what to do. Any help please?

I have the same problem with random.exe not showing up in hijackthis. Also I ran multiple scans in safe mode with the full version of anti malware. Now anti-malware shows to be blocking some websites and i still dont have access to internet through IE. The proxy settings all are unchecked.

I skipped that step and used Anti-Malware with the steps listed here and it worked, but I dunno if the other steps where really important tho.

I can't change the proxy settings either to remove the Antivir solutions pro. I also do not have another user account. I am working on a different computer. can I download the needed software to this cpu and then copy to cd and transfer to infected cpu?

Thank you so very much.
This was very helpful. I essentially modified the procedure twice. I needed to log into another ID to run anything. Secondly, I opted to restore to a previous session and then download and run the Malwarebytes. It worked beautifully, thanks!

I'm unable to run Malwarebytes Anti-Malware. It always crashes when scanning files in Windows\System32.

I did find the registry key with HijackThis, and told it to fix the issue, but I'm not sure it was truly fixed if Anti-Malware isn't running.

Has anyone ever seen this happen before?

I registered just to say thank you.
My mother expected me to fix her computer, and I tried almost everything. System Restore did nothing, neither did the recovery disc, for some reason it didn't work. I thought I was doomed and my mom would have to use my computer forever, we also lack money so we don't have anyway of paying for it to be repaired, nor a chance of getting a new computer.
However, this did work, but some of your links didn't work when they were clicked, but I just went to the links the manual way through google, and had to find the update software for the Anti-Malware program myself. I wouldn't have known how to fix her IE, nor her computer at all.
I am very thankful.
If I had money, I would definitely buy this product. It's amazing, and I will probably buy it in the future when I'm actually able to get a job! (If it's still around. )
THANK YOU!
(Also, I forgot to mention the update problem the Malware program was having and what-not, but I eventually got it to work just fine.)


Last edited by Forkk on 12th August 2010, 10:44 am; edited 2 times in total (Reason for editing : Forgot to add a bit of info.)