Remove AV Security Suite
AV Security Suite is a rogue program that is being used to replace other rogue programs. AV Security Suite replaces Antispyware Soft and AntispywareSoftware. Like other rogue programs AV Security Suite is a hoax, it is not a legit antivirus program, so please do not be fooled. The rogue program works by flooding your computer with popups that make it seem like your computer is infected, but the program will also pretend to run a scan and send you a scan report. The popups and fake reports get so bad that it becomes impossible to use your computer, which is what the rogue program is aiming for in the hopes that you will buy the tool. No matter how bad it gets do not buy the rogue program because it won’t fix anything!
Automatic AV Security Suite removal:
1.) To remove this rogue, you need to boot into Windows Safe Mode with Networking
(Learn how to boot into Safe Mode with Networking)
2.) Login to Windows and fix your Internet Explorer Proxy settings.
(Learn how to fix proxy settings)
3.) Stop the Antivirus Soft process: (random)sysguard.exe by downloading Process Explorer and ending the (random)sysguard.exe process. It has been renamed to explorer.com in order to trick Antivirus Soft to let it work. You can learn more about Process Explorer here
AV Security Suite Remover
Warning! If the automatic remover is blocked by the spyware, then boot into Windows Safe Mode and try again. Learn how to boot into Safe Mode here.
Manual AV Security Suite removal:
Kill processes: [random].exe, [random]tssd.exe
(Learn how to kill processes)
Unregister DLLs:
None
(Learn how to unregister DLLs)
Delete registry keys:
HKEY_CURRENT_USER\Software\avsoft
HKEY_CURRENT_USER\Software\avsuite
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = "0"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:1041"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ouferdbubtdve"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ouferdbubtdve"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
(Learn how to delete registry keys)
Delete files:
%Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random].exe
%Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\[random]tssd.exe
(Learn how to delete files)
Delete folders:
%Documents and Settings%\[UserName]\Local Settings\Application Data\[random string]\
Fix proxy settings
(Learn how to fix proxy settings)
Once you have removed AV Security Suite from your computer using either the automatic or manual method, make sure to block it and other malicious software using a HOSTS file. Please note that with the automatic method, your computer should be protected from future spyware threats since you now have a spyware blocker program installed. We recommend downloading the HOSTS file from here, which contains a complete, up-to-date list of malicious websites especially if you used the manual method.
If this article has helped you, please take this time to share it with Digg using the Digg button (see Digg share button to the left) or retweet it using Twitter (see retweet button to the left). You may also want to follow us on Twitter to keep up-to-date with the latest spyware prevention tips and spyware threats. If you'd rather follow us from your Facebook account, please join our Facebook fan page.
Follow Us!