How to Remove Antivirus Soft [Removal Guide]

First topic message reminder :


This guide will give you easy instructions on how to uninstall or get rid Antivirus Soft for free.


What is Antivirus Soft? (Information)

Antivirus Soft is a fake security software which uses fraudulent strategies by displaying false or exaggerated security issues on your computer rather than any legitimate ones to coerce you into purchasing their software.

Antivirus Soft is a new malicious specimen from the same group of fake antivirus software as Antivirus System Pro and Antivirus Live. It may be sometimes referred to as "Antivirus Soft Demo".

When it installs, it causes inevitable system mutation and annoying insecure activity of ransomware. It will then will trigger a large number of its obsessive and misleading notices such as fake infections and alerts like bankerfox.a and win32 nuqel.e. to trick you to believe of exposing multiple infections on the compromised computer. Upon completion of this disinformation attack, it will suggest that you buy a full version of it's product. Please do not fall of this scam and follow our removal guide to get rid of it completely.

Note: This guide also works for Antispyware Soft.


Antivirus Soft Screenshot




HijackThis Lines Present:

O4 - HKCU\..\Run: [[random file name]] "C:\Documents and Settings\user\Local Settings\Application Data\[random file name]\[random file name]sguard.exe


Antivirus Soft items:

C:\Documents and Settings\GeekPolice VM\Local Settings\Application Data\[random file name]\[random file name]sysguard.exe
HKEY_CURRENT_USER\Software\AvScan
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random file name]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random file name]"

---

Follow these preperation instructions to continue:

You have to start computer in Safe Mode by doing the following:

• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, keep tapping F8.
  
• Instead of Windows loading as normal, a menu should appear.
  
• Select the first option, to run Windows in Safe Mode with Networking.

If you are using Internet Explorer, click on the Tools menu and select Internet Options.

• Now click on the Connections tab and then the Lan Settings button.
  
• Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN.
  
• Click the OK button. Then press the Apply button and then the OK button. Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer.

If you are using Firefox, click on Tools and click the Advanced tab.

• Go to the Network tab and select Settings.
  
• Select No proxy and click the OK button and click OK again. Now that you have disabled the proxy server you will be able to browse the web again with Firefox.

---

1. Please download this version of Malwarebytes' Anti-Malware.




2. Install Malwarebytes' Anti-Malware by double clicking on mbam-setup




3. Follow the prompts. Make sure that Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware are checked. Then click finish.




4. Malwarebytes' Anti-Malware will automatically update itself after the installation, click the OK button to close that box and you will now be at the main program Window as shown below.

If you are having problems with the updater, you can use this link to manually update Malwarebytes' Anti-Malware with the latest database. Make sure that Malwarebytes' Anti-Malware is closed before installing the update.


5. Close All opened Windows, Programs, File or Folders.


6. Make sure you are on the Scanner tab. Select Perform quick scan then click the Scan button as shown below.




7. Malwarebytes' Anti-Malware will now start scanning your computer for infected files as shown below.




8. When the scan is finished a message box will appear, click OK to continue.




9. Click Show Results.




10. You will now be presented with a screen showing you the malware infections like shown below. Yours may look different depending on the infection you have.


11. Click on Remove selected.




12. When removing the files, Malwarebytes' Anti-Malware may require you to restart the computer in order to do a complete removal. If it displays a message stating that it needs to restart, click Yes.




13. After that you can close the Malwarebytes' Anti-Malware window, your computer is now cleaned from the malware infection.


To protect and prevent your computer from experiencing future threats like this, we highly recommend purchasing the FULL version of Malwarebytes' Anti-Malware with real-time protection from this link.

---

If you are still experiencing problems or difficulties following this guide or require any assistance removing this malware, please post your questions in our Virus, Spyware & Malware Removal forums for free help.

You have to be logged in to post questions. Registration is free. By registering you will be privileged to other resources and to ask questions.

I followed the procedure and - presto -no more virus. A very well explained solution. Thanks!

I had this Virus last week did all the instructions and it got rid of it. But today Its back I updated the malwarebytes program and it does not find it at all i did the full scan quick scan you name it. I can not get this thing off my computer now. If you have any info as to how to get it off please help thank you.



Update the scan just finished for the 3rd time just found 2 objects that are infected. They are as follows.

Registry Keys Infected:
HKEY_CURRENT_USER\Software\avsoft (Trojan.FakeAV) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ncakpqpf (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.

Hope this helps you guys out I know your pain and thank you to all those who are here to help you guys are awesome.

You guys did it again!! Thanks so much.

Just a tip....make sure you run the updates. The previous version won't find this virus.

Thanks again!!!

Are you supposed to download Malware while in safe mode?

Allie yes you can download it in safe mode.

I am having trouble just getting started with these steps. I get it started in safe mode and follow the instructions right up until I'm supposed to press "apply". I'm not given the option to do that, the button is greyed out. So upon simply closing I am not able to browse the web (I'm assuming still in safe mode?). What am I doing wrong or how can I continue on with the steps required?

Are you running standard safe mode or safe mode with networking? Safe mode won't close until restart. It shouldn't prompt you to run safe mode again, just automatically run standard windows. Are you using Internet Explorer or Mozilla Firefox? I run firefox but I also had an additional uninfected computer to download Malwarebytes. All you're doing by disabling the proxy server is allowing you to connect to the internet without additional incoming outside programs. If you can download the program from another computer, you can continue the steps as long as you install, update and run the program in safe mode on your infected computer. Try just running explorer normally in safe mode with networking, download the program and continue the steps as instructed and let us know how it goes.

boxedguy wrote:Are you running standard safe mode or safe mode with networking? Safe mode won't close until restart. It shouldn't prompt you to run safe mode again, just automatically run standard windows. Are you using Internet Explorer or Mozilla Firefox? I run firefox but I also had an additional uninfected computer to download Malwarebytes. All you're doing by disabling the proxy server is allowing you to connect to the internet without additional incoming outside programs. If you can download the program from another computer, you can continue the steps as long as you install, update and run the program in safe mode on your infected computer. Try just running explorer normally in safe mode with networking, download the program and continue the steps as instructed and let us know how it goes.

I'm running safe mode with networking. Basically, I've found that by disabling the proxy server I can't access anything online. I'm not really tech savvy, so I don't know what the issue there might be (i.e. firewall, etc.). I just know that I tried following the steps and wasn't able to hit apply. Now it appears that it did apply, because whenever I return to that menu it still has the box unchecked, but I can't access the internet without it

Try not disabling the proxy server. Shouldn't be too much of an issue if you can get it to download the program. Once you get it and update it, you should be golden.

Well, I downloaded it, then ran all the steps in safe mode. It quarantined & deleted a handful of items, but upon restarting it I still have the anti-virus soft demo crap popping up all the time. Ran quick scans, full scans, gotten the updates and ran everything again. Still no luck getting rid of this thing. Any further suggestions would be greatly appreciated!

I too add my thanks -- spent hours trying to figure it out -- but with this solution -- was a snap--
Isn't there someone that we can turn these guys into for this malicious trickery -- especially when they are actually selling services??
Johnny

Well It came back on my computer for the 3rd time in 2 weeks trying to get rid of it again malwarebytes seems to not be finding the affected files even after the update. I just check for another update and it found another so im running the full system scan again will see what happens. Man I whish they can do something to these guys cause this is starting to get on my nerves. Anyway Im using Norton 360 and somehow its not catching it. What anti virus soft ware you guys using that is not catching this?

Also wanted to express my appreciation for the solution provided here, as it worked extremely well for me also. Thanks for your diligence folk!

Much appreciated,

Andy

I've downloaded this program from two different sources (while in safe mode). I get same results. After installation I can't run the program. I get error message: Unable to execute file mbam.exe. There are lots of other files in this folder but not mbam.exe.

My PC is suffering under livesoftrock virus. Don't know why, but can't even do a system restore to an earlier date.

Any help is appreciated. Thanks, Gerry

Just a quick note to say that I followed the instructions provided and it has solved the problem!

My god that was the most annoying virus I've ever experienced...but at least the damage seems to be minimal.

I did notice that following the scan and clean I could connect to the internet with firefox, but not with IE, Curse Client, etc. I went into IE>Tools>Internet Options>Connections>Lan Settings and deselected the "use proxy server" option. That allowed me to once again access the internet with all programs. I'm pretty sure the instructions say to do that, but for some reason it didn't "take" for me the first time, so if you clean the virus from your computer but are still having trouble accessing the internet with some programs, you may want to try this.

Thank you so much for this fantastic site. Really saved my bacon. I had no idea it was here but will certainly be back for computer security issues (hopefully not often, lol).