spywareremovalguides.com

AV Clean Removal

virus removal man — Wed, 28 Jul 2010 06:53:12 +0000

One of the more notorious rogue anti-malware programs to plague computer users recently, AV Clean uses scare tactics to push users into the purchase of a bogus software license. AV Clean, which also passes under the name of AV-Clean, gets installed on user systems via Trojans that get downloaded from malicious websites. Once installed, AV Clean establishes itself as a startup service. It then proceeds to fabricate a large amount of fake virus scans at the end of which it claims that the computer is infected with myriad of viruses that aren’t really there.

AV Clean is also known to display fake pop-ups from the Windows taskbar as well as to install a Browser Helper Object which redirects the user’s web browser whenever he or she attempts to surf the internet. The aim of all this activity is to try and get the user to pay for the so-called ‘full’ version of AV-Clean by making them believe that the currently installed ‘trial’ version is incapable of cleaning out the detected ‘threats’ to the system. However, it should be kept in mind that no version of AV Clean can scan or properly clean any system.

As soon as you discover that your system is infected with AV Clean, you should initiate AV-Clean removal. In order to delete AV Clean, it is necessary to stop its processes, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step in AV-Clean removal is to stop the following processes from executing:

avreg.exe
avclean.exe

The next step in AV-Clean removal is the deletion of the following files and folders from your hard disk:

%ProgramFiles%\avclean\etc\avreg.exe
%ProgramFiles%\avclean\etc\avfilterdriver.sys
c:\DelUS.bat
%Temp%\AV CLEAN
%Programs%\AVClean
%Temp%\AV CLEAN\list_control
%Temp%\nsu2.tmp
%ProgramFiles%\AVClean
%ProgramFiles%\AVClean\db
%ProgramFiles%\AVClean\etc
%ProgramFiles%\AVClean\etc\temp
%ProgramFiles%\AVClean\Lang
%ProgramFiles%\AVClean\skin
%ProgramFiles%\AVClean\temp

After the above steps have been completed, AV Clean no longer resides on your hard disk.

Registry Removal Procedures

Removing files alone is not sufficient to get rid of AV Clean completely. To ensure complete AV-Clean removal, you must remove the following keys and settings from the Windows Registry as well:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] AVClean = “”%ProgramFiles%\AVClean\AVClean.exe” /Scan”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVClean] “AVClean”
[HKEY_LOCAL_MACHINE\SOFTWARE\Ebiz\AV CLEAN] “%ProgramFiles%\AVClean”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVFMON\0000\Control] “AVFMON”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVFMON\Security] “\??\%ProgramFiles%\avclean\etc\AVFilterDriver.SYS”

Now it is safe to say that AV Clean no longer exists on your computer. In order to certify this fact it is best advised to scan the entire computer with a genuine antivirus product such as Spyware Doctor with Antivirus. By doing so as part of the AV Clean removal process you will make sure that no additional malicious components reside on your PC.

Conclusion

Manual AV Clean removal is not safe in the case of inexperienced users, as any mistake made during removal could cause some serious damage to the operating system. Therefore inexperienced users are advised to make use of a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus when attempting to engage in AV-Clean removal.

SafetyPC Removal

virus removal man — Wed, 28 Jul 2010 06:47:31 +0000

One of the more dangerous rogue anti-malware programs that was initially developed for the Korean software market, SafetyPC has spread to all of the internet and threatens all computers today. This rogue application installs itself on user systems via Trojans that get downloaded from malicious websites all over the internet. Once installed, Safety PC initiates a large number of fake virus scans from which it will falsely report that the computer is dangerously infected with viruses that aren’t really there. It will also display pop-ups that claim that the computer is under threat from malware. SafetyPC is also known to install a browser helper object which redirects the user’s web browser to malicious websites promoting Safety PC whenever the user attempts to surf the internet. The aim of all this activity is to try and get the user to pay for a software license for the ‘full’ version of SafetyPC, which it claims is more capable of cleaning out the detected ‘threats’ than the currently installed ‘trial’ version. It is important to remember to never fall for this hoax as the so-called ‘full’ version of Safety PC is just as ineffective as the ‘trial’ version in removing potential threats.

As soon as you detect a copy of this rogue anti-malware on your computer, you should take steps to initiate SafetyPC removal. In order to remove Safety PC, it is necessary to stop processes, unregister DLLs, delete files and folders and remove registry entries.

File Removal Procedures

The first stop needed to be taken for SafetyPC removal is the stopping of the following processes:

safetypcux.exe
SafetyPC_Setup.exe
safetypceye.exe
safetypcup.exe
uninstall.exe

The next step is to unregister the following DLL file:

libmysql.dll

The final step in file removal related to SafetyPC removal is the deletion of the following files and folders:

Windows XP:

C:\Program Files\SafetyPC\safetypcux.exe
C:\Program Files\SafetyPC\libmysql.dll
C:\Program Files\SafetyPC
C:\Program Files\SafetyPC\SafetyPCDB
C:\Users\%USERNAME%\Desktop\SafetyPC_Setup.exe
C:\Program Files\SafetyPC\safetypceye.exe
C:\Program Files\SafetyPC\safetypcicon.ico
C:\Program Files\SafetyPC\safetypcup.exe
C:\Program Files\SafetyPC\uninstall.exe
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes000.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes001.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes002.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes003.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes004.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes005.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes006.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes007.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes008.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes009.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes010.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes011.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes012.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes013.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes014.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes015.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes016.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes017.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes018.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes019.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes020.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes021.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes022.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes023.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes024.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes025.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes026.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes027.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes028.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes029.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes030.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes031.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes032.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes033.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes034.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes035.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes036.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes037.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes038.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes039.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes040.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes041.cft
C:\Program Files\SafetyPC\SafetyPCDB\SafetyRes042.cft
C:\ Users\%USERNAME%\Desktop\SafetyPC.lnk

After the above steps have been completed, Safety PC no longer resides on your hard disk.

Registry Removal Procedures

File deletion alone is not sufficient to permanently remove SafetyPC from your computer. For complete Safety PC removal, it is necessary to remove the following keys and settings from the Windows Registry as well:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safetypc
HKEY_CURRENT_USER\Software\SafetyPC
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\safetypc

After the registry cleaning process has been completed, it is safe to say that SafetyPC no longer exists on your system. In order to make sure of this fact it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.

Conclusion

Manual Safety PC removal is not a recommended path for inexperienced computer users as any mistake made during removal could damage the software installed on your computer. Therefore, unless you an experienced systems administrator, you are advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to ensure that SafetyPC removal is completed safely and efficiently.

Anticare Removal

virus removal man — Wed, 28 Jul 2010 06:40:39 +0000

Anticare has proven to be a dangerous threat to internet users worldwide through scaring users into paying for a software license that does nothing for them. Anticare, like any other typical rogue anti-malware, installs itself on users systems via Trojans that get downloaded from malicious websites. Once established on the user’s system, Anticare loads itself as a startup service and then proceeds to perform fake anti-malware scans on the computer. This leads to a myriad of fake reports that state that the computer is dangerously infected with viruses that don’t exist. This is emphasized by using fake warning pop-ups that appear every now and then to annoy the user. The aim of all this activity is to try and get the user to pay for the ‘full’ version of Anticare under the claim that the currently installed ‘trial’ version is insufficient to remove the detected ‘threats’. However, it is important to remember not to fall for this ploy as no version of Anticare is capable of cleaning out any computer system successfully.

As soon as you detect an instance of this rogue software on your computer, you should take steps to initiate Anticare removal. In order to delete Anticare, you must stop its processes, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step in Anticare removal is the stopping of the following processes which are related to Anticare:

anticare.exe
avsrv.exe
avSubEngine.exe

The next step you need to take in order to remove Anticare is to delete the following files and folders:

%ProgramFiles%\Anticare\ACEngine.dll
%ProgramFiles%\pclock\pclocklauncher.exe
C:\Program Files\Anticare\ACEngine.dll
C:\Program Files\Anticare\AntiCare.exe
C:\Program Files\Anticare\partner.ini
C:\Program Files\Anticare\Uninstall.exe
C:\Program Files\Anticare\db\adsub.dat
C:\Program Files\Anticare\db\avmon.dat
C:\Program Files\Anticare\db\inter.dll
C:\Program Files\Anticare\db\vsdb.dat
C:\Program Files\Anticare\etc\acMon.exe
C:\Program Files\Anticare\etc\acReg.exe
C:\Program Files\Anticare\etc\avsrv.exe
C:\Program Files\Anticare\etc\avSubEngine.exe
C:\Program Files\Anticare\skin\default.avs

After the above steps have been completed, Anticare no longer resides on your hard disk.

Registry Removal Procedures

File deletion alone is not sufficient to ensure complete Anticare removal. To remove Anticare completely, you need to remove the following keys and settings from the Windows Registry as well:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiCareMain]
DisplayName = “Anticare”
UninstallString = “”%ProgramFiles%\Anticare\Uninstall.exe””
DisplayIcon = “”%ProgramFiles%\Anticare\Uninstall.exe””
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCLock]
DisplayName = “PCï¿½ï¿½Å´ï¿½ï¿½”
UninstallString = “”%ProgramFiles%\PCLock\Uninstall.exe””
DisplayIcon = “”%ProgramFiles%\PCLock\Uninstall.exe””
[HKEY_LOCAL_MACHINE\SOFTWARE\anticare]
pid = “pclock”
ver = “20100401?
Install_Dir = “%ProgramFiles%\Anticare”
reset = “20100607?
[HKEY_LOCAL_MACHINE\SOFTWARE\PCLock]
pid = “singsingfile”
ver = “20100520?
Install_Dir = “%ProgramFiles%\PCLock”
reset = “20100607?
holddate = “20100614?

Once the registry has been cleaned out, your computer is safe from Anticare. However, in order to make sure of this fact, it is recommended to run a full computer scan using genuine antivirus software such as Spyware Doctor with Antivirus.

Conclusion

Manual Anticare removal is not the best way to go if you are an inexperienced computer user who is not properly aware of security measures that should be taken to protect systems, as any wrong move during Anticare removal could cause damage to the operating system. Inexperienced users are therefore advised to make use of a web-based virus scanning and cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to remove Anticare.

Antivirus GT Removal

virus removal man — Wed, 28 Jul 2010 06:34:03 +0000

One of the most annoying and dangerous rogue anti-malware applications out there, Antivirus GT will attempt to scare innocent users into purchasing a fake software license. This rogue software application gets installed on user systems via Trojans that infiltrate the computer using security loopholes. Once installed, Antivirus GT will perform a large number of fake scans on the computer and insist that it is filled with a myriad of viruses. It will also display fake pop-ups from the Windows taskbar warning about viruses that don’t really exist. It will also redirect the web browser to a malicious website that promotes Antivirus GT whenever the user tries to surf the internet. The aim of all this activity is to trick the user into purchasing the ‘full’ version of Antivirus GT through the claim that the currently installed ‘trial’ version is not capable of properly removing the detected viruses. It is important to keep in mind that Antivirus GT is a fake application that cannot scan or clean your computer properly no matter what its version.

As soon as you detect a copy of this malicious application on your computer, you should initiate Antivirus GT removal. In order to delete Antivirus GT, you need to stop its processes, unregister its DLL files, remove its files and folders, and delete its registry entries.

File Removal Procedures

The first step you need to take in order to remove Antivirus GT is to stop the following processes from executing:

antivirus GT.exe
avgt.exe

Next in Antivirus GT removal is the unregistering of the following DLL:

MicrosoftExtensions.dll

The next step in Antivirus GT removal is to delete the following files and folders:

Windows XP:

c:\Documents and Settings\All Users\Start Menu\AVGT\
c:\Documents and Settings\All Users\Start Menu\AVGT\AntivirusGT.lnk
c:\Documents and Settings\All Users\Start Menu\AVGT\Uninstall.lnk
c:\Program Files\AVGT\
c:\Program Files\AVGT\antivirusGT.exe
%UserProfile%\Desktop\AntivirusGT.lnk
C:\Documents and Settings\[User Name]\Local Settings\Temp\MicrosoftExtensions.dll

Windows Vista/7:

c:\Users\%USERNAME%\My Documents\AVGT\
c:\ Users\%USERNAME%\My Documents \AVGT\AntivirusGT.lnk
c:\ Users\%USERNAME%\My Documents \AVGT\Uninstall.lnk
c:\Program Files\AVGT\
c:\Program Files\AVGT\antivirusGT.exe
%UserProfile%\Desktop\AntivirusGT.lnk
C:\ Users\%USERNAME%\My Documents \Local Settings\Temp\MicrosoftExtensions.dll

Once this is done, it is recommended to scan the entire PC using genuine antivirus software such Spyware Doctor with Antivirus in order to make sure that there are no additional threats residing on your PC. Due to the fact that Antivirus GT removal is a difficult process in many cases, proper caution is recommended.

Registry Removal Procedures

File deletion alone is not sufficient to completely remove Antivirus GT from your computer. In order to ensure complete Antivirus GT removal, it is necessary to delete the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\EVA246
HKEY_CURRENT_USER\Software\WinFD
HKEY_CLASSES_ROOT\CLSID\{3304F17F-732C-4AC6-BF67-DBDC8B88C11F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3304F17F-732C-4AC6-BF67-DBDC8B88C11F}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AVGT”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “WinNT-EVI 05.07.2010″

Now it is safe to say that you have completely removed Antivirus GT from your computer.

Conclusion

Manual Antivirus GT removal is not recommended for novice users as any mistake on your part could cause damage to the operating system. Therefore the best way to go if you are inexperienced is to use a web-based virus scanning and cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus for Antivirus GT removal.

Defense Center Removal

virus removal man — Fri, 25 Jun 2010 18:29:43 +0000

Defense Center is a malicious program that is related to the notorious rogue program Protection Center. It tries to trick users into paying for a license to its ‘full’ version. Defense Center gets installed on user systems via Trojan viruses that get downloaded from malicious websites which claim to contain malware scanning services. Once installed, it immediately blocks any legitimate security software that the user may have installed on their computer. Defense Center also runs endless fake virus scans and reports that the user’s system is infected with dangerous malicious software. It also displays fake warning pop-ups from the Windows taskbar. Meanwhile it constantly requests the user to upgrade to the ‘full’ version of Defense Center by paying for a software license, claiming that the currently installed ‘trial’ version is incapable of properly removing the detected false ‘threats’. However, no user should allow him to be tricked into buying this software, as the ‘full’ version of Defense Center is just as incapable of cleaning a computer system as the ‘trial’ version is.

It is extremely important to initiate Defense Center removal as soon as you find any signs of it being installed on your computer. In order to remove Defense Center properly, it is needed to stop its processes, unregister its DLLs, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you must take in order to delete Defense Center is to stop the following processes:

mswinsck.exe
wscsvc32.exe
defcnt.exe
uninstall.exe

Next, it is necessary to unregister the following DLL files to continue with Defense Center removal:

fiosejgfse.dll
defext.dll
defhook.dll

The next step in Defense Center removal is the deletion of the following files and folders:

%documents and settings%\all users\application data\fiosejgfse.dll
%temp%\mswinsck.exe
%temp%\wscsvc32.exe
%appdata%\microsoft\internet explorer\quick launch\Defense Center.lnk
%desktop%\Defense Center support.lnk
%desktop%\Defense Center.lnk
%commonprograms%\Defense Center\about.lnk
%commonprograms%\Defense Center\activate.lnk
%commonprograms%\Defense Center\buy.lnk
%commonprograms%\Defense Center\Defense Center support.lnk
%commonprograms%\Defense Center\Defense Center.lnk
%commonprograms%\Defense Center\scan.lnk
%commonprograms%\Defense Center\settings.lnk
%commonprograms%\Defense Center\update.lnk
%programfiles\Defense Center\about.ico
%programfiles\Defense Center\activate.ico
%programfiles\Defense Center\buy.ico
%programfiles\Defense Center\def.db
%programfiles\Defense Center\defext.dll
%programfiles\Defense Center\defhook.dll
%programfiles\Defense Center\defcnt.exe
%programfiles\Defense Center\help.ico
%programfiles\Defense Center\scan.ico
%programfiles\Defense Center\settings.ico
%programfiles\Defense Center\splash.mp3
%programfiles\Defense Center\uninstall.exe
%programfiles\Defense Center\update.ico
%programfiles\Defense Center\virus.mp3

After the above steps have been completed, your hard disk is free from files and folders belonging to Defense Center.

Registry Removal Procedures

Removing files and folders alone is not sufficient for complete Defense Center removal. In order to remove Defense Center completely, the following keys and settings should be removed from the Windows Registry:

hkcr\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
hklm\SOFTWARE\Defense Center
hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Defense Center
hklm\SOFTWARE\Paladin Antivirus
hkcu\Software\Microsoft\Windows\CurrentVersion\Run “Defense Center”
hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved “{5E2121EE-0300-11D4-8D3B-444553540000}”

Now it is safe to say that your computer is completely safe from Defense Center. However, in order to make sure of this fact, it is recommended to conduct a full system sweep using genuine antivirus software such as Spyware Doctor with Antivirus

Conclusion

Manual Defense Center removal is not recommended for inexperienced users, as any mistake made during removal could potentially damage the operating system of the computer. Therefore inexperienced users are advised to use a legitimate antivirus program such as Spyware Doctor with Antivirus or a web-based system scanner such as www.onlinecomputerrepair.org to ensure safe Defense Center removal.

Sysinternals Antivirus Removal

virus removal man — Wed, 16 Jun 2010 23:01:30 +0000

Sysinternals Antivirus is a malicious program that is related to the notorious rogue program Your PC Protector. It tries to trick users into paying for a license to its ‘full’ version. Sysinternals Antivirus gets installed on user systems via Trojan viruses that get downloaded from malicious websites which claim to contain malware scanning services. Once installed, it immediately blocks any legitimate security software that the user may have installed on their computer. Sysinternals Antivirus also runs endless fake virus scans and reports that the user’s system is infected with dangerous malicious software. It also displays fake warning pop-ups from the Windows taskbar. Meanwhile it constantly requests the user to upgrade to the ‘full’ version of Sysinternals Antivirus by paying for a software license, claiming that the currently installed ‘trial’ version is incapable of properly removing the detected false ‘threats’. However, no user should allow themselves to be tricked into buying this software, as the ‘full’ version of Sysinternals Antivirus is just as incapable of cleaning a computer system as the ‘trial’ version is.

As soon as you detect a copy of this rogue software on your computer, you should initiate the process of Sysinternals Antivirus removal. In order to delete Sysinternals Antivirus, you need to stop its processes, unregister its DLLS, delete its files and folders and remove its registry entries.

File Removal Procedures

The first step you need to take in order to remove Sysinternals Antivirus is to stop the following processes:

alggui.exe
svchost.exe
Sysinternals Antivirus.exe
dbsinit.exe
ccsmn.exe
ccsrr.exe

The 2nd step in Sysinternals Antivirus removal is the unregistration of the following DLL files:

adc32.dll
adc_w32.dll

Next, it is necessary to delete the following files and folders:

Windows XP:

c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\lleod150
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmharun.log
%UserProfile%\Application Data\Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk

Windows Vista / 7:

c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe
%UserProfile%\AppData\Microsoft\Internet Explorer\ccsmn.exe
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151.acf
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151.ltd
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151.lti
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151_0.acb
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151_0.aci
%UserProfile%\ AppData \Microsoft\Internet Explorer\ccsmn151_0.mt
%UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe
%UserProfile AppData \Microsoft\Internet Explorer\lleod150
%UserProfile%\ AppData \Microsoft\Internet Explorer\wmharun.log
%UserProfile%\ AppData \Microsoft\Internet Explorer\wmrun.log
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus
%UserProfile%\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk

Your computer’s hard disk no longer contains any files and folders belonging to Sysinternals Antivirus.

Registry Removal Procedures

File deletion alone is not sufficient to completely remove Sysinternals Antivirus. The following keys and settings should be removed from the registry for complete Sysinternals Antivirus removal:

HKCU\Software\Sysinternals Antivirus
HKCR\CLSID\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}
HKLM\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Sysinternals Antivirus
HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “novavapp”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “novavappr”

Tips & Tricks

Manual Sysinternals Antivirus removal is not recommended for inexperienced users, as any mistake made during removal could potentially damage the operating system of the computer. Therefore inexperienced users are advised to use a legitimate antivirus program such as Spyware Doctor with Antivirus or a web-based system scanner such as www.onlinecomputerrepair.org to ensure safe Sysinternals Antivirus removal.

Spyware Cleaner 2010 Removal

virus removal man — Wed, 16 Jun 2010 22:52:27 +0000

Spyware Cleaner 2010 is a malicious anti-spyware application that imitates legitimate anti-malware programs. Spyware Cleaner 2010 uses scare tactics the same as other rogue antimalware applications to trick users into purchasing a license to its full version. This malicious application reaches the user’s computer via Trojans that get downloaded from malicious websites which claim to be able to help you with your security. Once established on the computer, Spyware Cleaner 2010 then proceeds to perform a large number of fake security scans on the system, returning results that state that the computer is dangerously infected with a number of non-existent viruses. It also generates fake warning pop-ups from the Windows taskbar. Finally Spyware Cleaner 2010 urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is incapable of cleaning the detected false ‘threats’. However, all users should be aware that this is a trick aimed at swindling their money, as no version of System Security can scan or clean any computer.

As soon as you find a copy of this malicious software installed on your computer, you should take steps to delete Spyware Cleaner 2010. Spyware Cleaner 2010 removal involves the stopping of processes, the removal of files and folders and the deletion of registry entries.

File Removal Procedures

The first step you need to take in order to remove Spyware Cleaner 2010 is to stop the following processes from running:

SpywareCleaner.exe
unins000.exe

Next, it is necessary to delete the following files and folders for Spyware Cleaner 2010 removal:

SpywareCleaner.exe
unins000.exe

Once the above steps have been completed, no instances of Spyware Cleaner 2010 reside on your hard disk any longer.

Registry Removal Procedures

Deleting files and folders is not sufficient to completely delete Spyware Cleaner 2010. In order for complete Spyware Cleaner 2010 removal, the following registry entry should be removed from the Windows Registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Spyware Cleaner 2010?

Conclusion

Manual Spyware Cleaner 2010 removal is not recommended for inexperienced users as any wrong move made during the removal process could cause irreversible damage to the operating system of the computer. Therefore inexperienced users are strongly advised to use a web-based repair service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to safely remove Spyware Cleaner 2010.

AV Security Suite Removal

virus removal man — Wed, 16 Jun 2010 22:40:55 +0000

AV Security Suite is fake anti-spyware program which imitates a legitimate antimalware application and belongs to the notorious Antivirus Live family of rogue malware. It acts in the same manner as its predecessors, Antivirus Soft and Antispyware Soft, by trying to convince users to buy a license for the software. AV Security Suite enters a user’s computer via Trojans that arrive at the user’s system via infected PDF files. Once it has been installed on the user’s system, AV Security Suite starts performing fake system scans at regular intervals, returning results that claim that the user’s system is under serious threat. It also creates a number of harmless files that it later detects as dangerous viruses. AV Security Suite uses a Windows-style GUI and pop-ups generated from the Windows taskbar to convince users that this is the real thing. Then it claims that the currently installed ‘trial’ version is inadequate to remove the previously detected false ‘threats and urges the user the pay for the ‘full’ version of the software. However, the ‘full’ version is no more capable of cleaning a user’s system than the ‘trial’ version; therefore no user should ever purchase the false license to this rogue software.

As soon as you find a copy of this malicious software installed on your computer, you should take steps to delete AV Security Suite. AV Security Suite removal involves the stopping of processes, removal of files and folders and the deletion of registry entries. However, before attempting this you should restart your computer in Safe Mode.

File Removal Procedures

The first step you need to take in order to remove AV Security Suite from your computer is to kill the following processes:

[random characters]tssd.exe
[random characters].exe

Next, it is necessary to remove the following files and folders from the hard disk in order to continue with AV Security Suite removal:

Windows XP:

%Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe
%Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters].exe
Windows Vista/7
%USER%\AppData\[random characters ]\[random characters]tssd.exe
%USER%\AppData \[random characters ]\[random characters].exe

Once the above steps have been completed, it is safe to say that there are no more files belonging to AV Security Suite on your hard disk. In order to make sure of this fact, especially when working within a sensitive environment that contains a lot of personal data and work related files, it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

File deletion alone is not sufficient to completely remove AV Security Suite. The following keys and settings should be removed from the Windows Registry for complete AV Security Suite removal:

HKEY_CURRENT_USER\Software\AvScan
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random characters]“
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random characters]“
HKEY_CURRENT_USER\Software\avsoft
HKEY_CURRENT_USER\Software\avsuite
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″

After the registry cleaning portion of AV Security Suite removal has been completed, your computer is safe from this rogue software.

Conclusion

Manual Security Center AV removal is not recommended for inexperienced users as any wrong move made during removal could cause damage to the system. The best tactic that inexperienced users can employ is to make use of web-based computer scanning/cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to ensure complete and safe AV Security Suite removal.

How to Remove Security Master AV

virus removal man — Wed, 09 Jun 2010 01:03:35 +0000

Security Master AV is a rogue anti-spyware that aggressively sells itself to users by showing fake threat reports and scan results. It is related to the notorious rogue programs known by the names of My Security Engine and Cleanup Antivirus. Security Master AV gets installed on a user’s computer through fake websites that install a Trojan. Once installed, Security Master AV immediately disables essential Windows utilities such as Task Manager and Registry Editor to prevent the user from attempting to manually remove it. Then, Security Master AV starts to display fake pop-ups, claiming that the integrity of the system has been compromised due to the presence of dangerous spyware. Its GUI is extremely authentic-looking, and starts conducting fake scans as soon as it is open, flagging legitimate user programs as viruses and spyware. It also tries to convince the user that the currently installed ‘trial’ version is not sufficient to remove these threats, and that the user should pay for ‘activation’ of Security Master AV. It should be noted that the ‘full’ version of Security Master AV, once purchased, has no capability whatsoever to clean your computer and this is a trick that you should never fall for.

The following sections outline how to remove Security Master AV. Security Master AV removal involves the stopping of processes, unregistering of DLLs, removal of files and folders and the deletion of registry entries. However, before attempting this you should restart your computer in Safe Mode.

File Removal Procedures

The first in Security Master AV removal is the stopping of the following processes:

SM8d7c.exe
ANTIGEN.exe
std.exe
SM345d.exe

Next, it is necessary to unregister the following DLL files to continue with Security Master AV removal:

cid.dll
ddv.dll
runddlkey.dll
sqlite3.dll
mozcrt19.dll

The next step that has to be taken to remove Security Master AV is the deletion of the following files and folders:

Windows XP:

%CommonAppData%\8d7ca11\25.mof
%CommonAppData%\8d7ca11\SM8d7c.exe
%CommonAppData%\8d7ca11\SMAV.ico
%CommonAppData%\8d7ca11\SMAVSys\vd952342.bd
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk
%AppData%\Security Master AV\cookies.sqlite
%Desktop%\Security Master AV.lnk
%UserProfile%\Recent\ANTIGEN.drv
%UserProfile%\Recent\ANTIGEN.exe
%UserProfile%\Recent\cid.dll
%UserProfile%\Recent\CLSV.drv
%UserProfile%\Recent\DBOLE.sys
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\ddv.sys
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\FS.drv
%UserProfile%\Recent\gid.drv
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\PE.sys
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\std.exe
%UserProfile%\Recent\tjd.drv
%UserProfile%\Recent\tjd.sys
%UserProfile%\Recent\runddlkey.dll
%StartMenu%\Security Master AV.lnk
%StartMenu%\Programs\Security Master AV.lnk
c:\Documents and Settings\All Users\Application Data\345d567\
c:\Documents and Settings\All Users\Application Data\345d567\16.mof
c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\345d567\SM345d.exe
c:\Documents and Settings\All Users\Application Data\345d567\SMAV.ico
c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\345d567\Quarantine Items\
c:\Documents and Settings\All Users\Application Data\345d567\SMAVSys\
c:\Documents and Settings\All Users\Application Data\345d567\SMAVSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\SMNPCTCAV\
c:\Documents and Settings\All Users\Application Data\SMNPCTCAV\SMMPIBBZGHAV.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk
Windows Vista / Windows 7:
%CommonAppData%\8d7ca11\25.mof
%CommonAppData%\8d7ca11\SM8d7c.exe
%CommonAppData%\8d7ca11\SMAV.ico
%CommonAppData%\8d7ca11\SMAVSys\vd952342.bd
%AppData%\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk
%AppData%\Security Master AV\cookies.sqlite
%Desktop%\Security Master AV.lnk
%UserProfile%\Recent\ANTIGEN.drv
%UserProfile%\Recent\ANTIGEN.exe
%UserProfile%\Recent\cid.dll
%UserProfile%\Recent\CLSV.drv
%UserProfile%\Recent\DBOLE.sys
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\ddv.sys
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\FS.drv
%UserProfile%\Recent\gid.drv
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\PE.sys
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\std.exe
%UserProfile%\Recent\tjd.drv
%UserProfile%\Recent\tjd.sys
%UserProfile%\Recent\runddlkey.dll
%StartMenu%\Security Master AV.lnk
%StartMenu%\Programs\Security Master AV.lnk
c:\Users\%USER%\AppData\345d567\
c:\ Users\%USER%\AppData \345d567\16.mof
c:\ Users\%USER%\AppData \345d567\mozcrt19.dll
c:\ Users\%USER%\AppData \345d567\SM345d.exe
c:\ Users\%USER%\AppData \345d567\SMAV.ico
c:\ Users\%USER%\AppData \345d567\sqlite3.dll
c:\ Users\%USER%\AppData \345d567\Quarantine Items\
c:\ Users\%USER%\AppData \345d567\SMAVSys\
c:\ Users\%USER%\AppData \345d567\SMAVSys\vd952342.bd
c:\ Users\%USER%\AppData \SMNPCTCAV\
c:\ Users\%USER%\AppData \SMNPCTCAV\SMMPIBBZGHAV.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Master AV.lnk

Registry Removal Procedures

File deletion alone is not sufficient to completely remove Security Master AV. The following keys and settings should be removed from the Windows Registry for complete Security Master AV removal:

HKEY_CURRENT_USER\Software\3
HKEY_CLASSES_ROOT\SMAVSys.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Security Master AV”
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\SM345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q={searchTerms}”
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=7&q={searchTerms}”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = “no”

Now it is safe to say that Security Master AV will no longer plague your system. Even if this will be true in most cases, it is recommended to conduct a full system scan using genuine antivirus software such as Spyware Doctor with Antivirus in order to identify any additional possible malicious components.

Conclusion

Even if you have a good knowledge on how to remove Security Master AV, you should not attempt to do it manually if you are an inexperienced computer user. Any mistake made during removal could cause untold damage to the operating system. Therefore it is recommended to use a legitimate antivirus application such as Spyware Doctor with Antivirus or web-based repair service such as www.onlinecomputerrepair.org for safe Security Master AV removal.

How to Remove Protection Center

virus removal man — Wed, 09 Jun 2010 00:57:47 +0000

Protection Center is a malicious anti-spyware application that has been derived from a number of rogue programs, namely, Digital Protection, Dr. Guard, Your Protection and Data Protection, and tries to trick users into purchasing its license. This malicious application reaches the user’s computer via Trojans that get downloaded from malicious websites. Once established on the user’s system, Protection Center loads itself as a startup service at boot time. Protection Center proceeds to perform a large number of fake security scans on the system, returning results that state that the computer is dangerously infected with a number of non-existent viruses. It also generates fake warning pop-ups from the Windows taskbar. Finally Protection Center urges the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is incapable of cleaning the detected false ‘threats’. However, all users should be aware that this is a trick aimed at swindling their money, as no version of Protection Center can scan or clean any computer.

The following chapters will show you how to remove Protection Center. Protection Center removal involves the stopping of processes, the unregistering of DLL files, the removal of files and folders and the deletion of registry entries.

File Removal Procedures

The first step you need to take in order to remove Protection Center is to kill the following processes:

cntprot.exe
Uninstall.exe

Next, it is necessary to unregister the following DLL files which belong to Protection Center:

cntext.dll
cnthook.dll

The final step in the file deletion phase of Protection Center removal is the actual deletion of the following files and folders:

c:\Program Files\Protection Center\about.ico
c:\Program Files\Protection Center\activate.ico
c:\Program Files\Protection Center\buy.ico
c:\Program Files\Protection Center\cnt.db
c:\Program Files\Protection Center\cntext.dll
c:\Program Files\Protection Center\cnthook.dll
c:\Program Files\Protection Center\cntprot.exe
c:\Program Files\Protection Center\help.ico
c:\Program Files\Protection Center\scan.ico
c:\Program Files\Protection Center\settings.ico
c:\Program Files\Protection Center\splash.mp3
c:\Program Files\Protection Center\Uninstall.exe
c:\Program Files\Protection Center\update.ico
c:\Program Files\Protection Center\virus.mp3
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Protection Center.lnk
%UserProfile%\Desktop\Protection Center Support.lnk
%UserProfile%\Desktop\Protection Center.lnk
%UserProfile%\Start Menu\Programs\Protection Center\
%UserProfile%\Start Menu\Programs\Protection Center\About.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Activate.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Buy.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Protection Center Support.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Protection Center.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Scan.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Settings.lnk
%UserProfile%\Start Menu\Programs\Protection Center\Update.lnk

Now no instances of Protection Center reside on your hard disk any longer. However, in order to certify of this fact it is required to scan the entire computer using a legitimate antivirus product such as Spyware Doctor with Antivirus.

Registry Removal Procedures

In order to completely remove Protection Center, it is necessary to remove the following keys and settings from the Windows Registry:

HKEY_CURRENT_USER\Software\Classes\secfile
HKEY_CURRENT_USER\Software\Malware Defense
HKEY_CURRENT_USER\Software\Paladin Antivirus
HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKEY_CLASSES_ROOT\secfile
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Protection Center
HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Protection Center
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Protection Center”

After the above steps have been completed, it is safe to say that Protection Center has been completely removed from your computer.

Conclusion

Even though an inexperienced computer user may have full knowledge on how to remove Protection Center, it is not recommended that they attempt it as any mistake made during removal could cause damage to the system. Therefore inexperienced users are advised to make use of a web-based malware scanning/cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software such as Spyware Doctor with Antivirus to remove Protection Center.