Remove Antivirus Suite

Antivirus Suite also known as AntivirusSuite is a new spyware variant of Antivirus Soft. Just like its predecessor, this spyware is spread by fake malware scanner websites. Once Antivirus Suite is downloaded onto your computer, it will automatically scan your files whenever Windows is rebooted. This scan will return an infection report indicating your PC is infected with numerous viruses. The scan and report are both fake. Ignore any prompts and popups to buy Antivirus Suite in order to fix the displayed infections. This rogue program is a total scam. Follow the instructions below to remove it.

Automatic Antivirus Suite removal:

1.) To remove this rogue, you need to boot into Windows Safe Mode with Networking
(Learn how to boot into Safe Mode with Networking)
2.) Login to Windows and fix your Internet Explorer Proxy settings.
(Learn how to fix proxy settings)
3.) Stop the Antivirus Soft process: (random)sysguard.exe by downloading Process Explorer and ending the (random)sysguard.exe process. It has been renamed to explorer.com in order to trick Antivirus Soft to let it work. You can learn more about Process Explorer here

Antivirus Suite Remover

Warning! If the automatic remover is blocked by the spyware, then boot into Windows Safe Mode and try again. Learn how to boot into Safe Mode here.

Manual Antivirus Suite removal:

Kill processes: (random)tssd.exe
(Learn how to kill processes)

Unregister DLLs:
None
(Learn how to unregister DLLs)

Delete registry keys:
HKEY_CURRENT_USER\Software\avsuite HKEY_LOCAL_MACHINE\SOFTWARE\avsuite HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = " HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "" HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
(Learn how to delete registry keys)

Delete files:
Windows XP Files
%UserProfile%\Local Settings\Application Data\(random)\(random)tssd.exe

Windows Vista and 7 Files
%UserProfile%\AppData\Local\(random)\(random)tssd.exe
(Learn how to delete files)

Delete folders:
Windows XP Files
%UserProfile%\Local Settings\Application Data\(random)\

Windows Vista and 7 Files
%UserProfile%\AppData\Local\(random)\

Fix proxy settings
(Learn how to fix proxy settings)

Once you have removed Antivirus Suite from your computer using either the automatic or manual method, make sure to block it and other malicious software using a HOSTS file. Please note that with the auomatic method, your computer should be protected from future spyware threats since you now have a spyware blocker program installed. We recommend downloading the HOSTS file from here, which contains a complete, up-to-date list of malicious websites especially if you used the manual method.

If this article has helped you, please take this time to share it with Digg using the Digg button (see Digg share button to the left) or retweet it using Twitter (see retweet button to the left). You may also want to follow us on Twitter to keep up-to-date with the latest spyware prevention tips and spyware threats. If you'd rather follow us from your Facebook account, please join our Facebook fan page.