Live Security Platinum - Virus Removal Guide

Live Security Platinum is a computer virus which will display fake security alerts,reporting that malware has been detected on your computer.This alerts are professional looking pop-ups and when you click on them, you are advised to buy Live Security Platinum in order to remove the detected threats.
In reality, none of the reported issues are real, and are only used to scare you into buying Live Security Platinum and stealing your personal financial information.

Apart from the bogus alerts,as part of its self-defense mechanism,Live Security Platinum has disabled the Windows system utilities, including the Windows Task Manager and Registry Editor,and will block you from running certain programs that could lead to its removal.
Further more,this rogue antivirus has modified your Windows files associations so now you can’t run files that end in a .exe extension.

If your computer is infected with Live Security Platinum,then you are seeing this images:

Registration codes for Live Security Platinum
As an optional step,you can use the following license key to register Live Security Platinum and stop the fake alerts.
Live Security Platinum license key: AA39754E-715219CE
Please keep in mind that entering the above registration code will NOT remove Live Security Platinum from your computer , instead it will just stop the fake alerts so that you’ll be able to complete our removal guide more easily.

Live Security Platinum Removal Guide

STEP 1 : Start your computer in Safe Mode with Networking

Remove all floppy disks, CDs, and DVDs from your computer, and then restart your computer.
Press and hold the F8 key as your computer restarts.Please keep in mind that you need to press the F8 key before the Windows start-up logo appears.
Note: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the “F8 key”, tap the “F8 key” continuously until you get the Advanced Boot Options screen.
On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking , and then press ENTER.

STEP 2: Remove Live Security Platinum malicious proxy server

Live Security Platinum may add a proxy server which prevents the user from accessing the internet,follow the below instructions to remove the proxy.

Start the Internet Explorer browser and if you are using Internet Explorer 9 ,click on the gear icon (Tools for Internet Explorer 8 users) ,then select Internet Options.
Go to the tab Connections.At the bottom, click on LAN settings.
Uncheck the option Use a proxy server for your LAN. This should remove the malicious proxy server and allow you to use the internet again.

If you are a Firefox users, go to Firefox(upper left corner) → Options → Advanced tab → Network → Settings → Select No Proxy

STEP 3: Repair your Windows Registry from Live Security Platinum malicious changes.

Smart Fortress 2012 has changed your Windows registry settings so that when you try to run a executable file (ending with .exe ) , it will instead launch the infection rather than the desired program.

Download the registryfix.reg file to fix the malicious registry changes from Live Security Platinum.
REGISTRYFIX.REG DOWNLOAD LINK (This link will automatically download the registry fix called registryfix.reg)
Double-click on registryfix.reg file to run it. Click “Yes” for Registry Editor prompt window,then click OK.

STEP 4: Run RKill to terminate known malware processes associated with Live Security Platinum.

RKill is a program that will attempt to terminate all malicious processes associated with Live Security Platinum,so that we will be able to perform the next step without being interrupted by this malicious software.
Because this utility will only stop Live Security Platinum running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again.

While your computer is in Safe Mode with Networking ,please download the latest official version of RKill.Please note that we will use a renamed version of RKILL so that Live Security Platinum won’t block this utility from running.
RKILL DOWNLOAD LINK (This link will automatically download RKILL renamed as iExplore.exe)
Double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Live Security Platinum.
RKill will now start working in the background, please be patient while the program looks for various malware programs and tries to terminate them.

IF you are having problems starting or running RKill, you can download any other renamed versions of RKill from here.
When Rkill has completed its task, it will generate a log. You can then proceed with the rest of the guide.

WARNING: Do not reboot your computer after running RKill as the malware process will start again , preventing you from properly performing the next step.

STEP 5: Remove Live Security Platinum malicious files with Malwarebytes Anti-Malware FREE

Download the latest official version of Malwarebytes Anti-Malware FREE.
MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
Start the Malwarebytes’ Anti-Malware installation process by double clicking on mbam-setup file.
When the installation begins, keep following the prompts in order to continue with the setup process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware checked. Then click on the Finish button. If Malwarebytes’ prompts you to reboot, please do not do so.
Malwarebytes Anti-Malware will now start and you’ll be prompted to start a trial period , please select ‘Decline‘ as we just want to use the on-demand scanner.
On the Scanner tab,select Perform full scan and then click on the Scanbutton to start scanning your computer.
Malwarebytes’ Anti-Malware will now start scanning your computer for Live Security Platinum malicious files as shown below.
When the scan is finished a message box will appear, click OK to continue.
You will now be presented with a screen showing you the malware infections that Malwarebytes’ Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selected button.
Malwarebytes’ Anti-Malware will now start removing the malicious files.After completing this task it will display a message stating that it needs to reboot,please allow this request and then let your PC boot in Normal mode.

STEP 6: Double check your system for any left over infections with HitmanPro

This step can be performed in Normal Mode ,so please download the latest official version of HitmanPro.
HITMANPRO DOWNLOAD LINK (This link will open a download page in a new window from where you can download HitmanPro)
Double click on the previously downloaded fileto start the HitmanPro installation.

IF you are experiencing problems while trying to start HitmanPro, you can use the Force Breach mode.To start HitmanPro in Force Breach mode, hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including the malware process. (How to start HitmanPro in Force Breach mode – Video)
Click on Next to install HitmanPro on your system.
The setup screen is displayed, from which you can decide whether you wish to install HitmanPro on your machine or just perform a one-time scan, select a option then click on Next to start a system scan.
HitmanPro will start scanning your system for malicious files as seen in the image below.
Once the scan is complete,you’ll see a screen which will display all the malicious files that the program has found.Click on Next to remove this malicious files.
Click Activate free license to start the free 30 days trial and remove the malicious files.
HitmanPro will now start removing the infected objects.If this program will ask you to restart your computer,please allow this request.

STEP 7: Remove the left over malicious registry keys and files

Live Security Platinum has sadded some malicious registry keys to your Windows installation , to remove this malicious changes we need to run a scan with RogueKiller.

Please download the latest official version of RogueKiller.
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
After the scan has completed, press the Delete button to remove any malicious registry keys.
Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

If you are still experiencing problems while trying to remove Live Security Platinum from your machine, please start a new thread in our Malware Removal Assistance forum.

How to Stay Safe Online

Here are 10 basic security tips to help you avoid malware and protect your device:

Use a good antivirus and keep it up-to-date.

It's essential to use a good quality antivirus and keep it up-to-date to stay ahead of the latest cyber threats. We are huge fans of Malwarebytes Premium and use it on all of our devices, including Windows and Mac computers as well as our mobile devices. Malwarebytes sits beside your traditional antivirus, filling in any gaps in its defenses, and providing extra protection against sneakier security threats.
Keep software and operating systems up-to-date.

Keep your operating system and apps up to date. Whenever an update is released for your device, download and install it right away. These updates often include security fixes, vulnerability patches, and other necessary maintenance.
Be careful when installing programs and apps.

Pay close attention to installation screens and license agreements when installing software. Custom or advanced installation options will often disclose any third-party software that is also being installed. Take great care in every stage of the process and make sure you know what it is you're agreeing to before you click "Next."
Install an ad blocker.

Use a browser-based content blocker, like AdGuard. Content blockers help stop malicious ads, Trojans, phishing, and other undesirable content that an antivirus product alone may not stop.
Be careful what you download.

A top goal of cybercriminals is to trick you into downloading malware—programs or apps that carry malware or try to steal information. This malware can be disguised as an app: anything from a popular game to something that checks traffic or the weather.
Be alert for people trying to trick you.

Whether it's your email, phone, messenger, or other applications, always be alert and on guard for someone trying to trick you into clicking on links or replying to messages. Remember that it's easy to spoof phone numbers, so a familiar name or number doesn't make messages more trustworthy.
Back up your data.

Back up your data frequently and check that your backup data can be restored. You can do this manually on an external HDD/USB stick, or automatically using backup software. This is also the best way to counter ransomware. Never connect the backup drive to a computer if you suspect that the computer is infected with malware.
Choose strong passwords.

Use strong and unique passwords for each of your accounts. Avoid using personal information or easily guessable words in your passwords. Enable two-factor authentication (2FA) on your accounts whenever possible.
Be careful where you click.

Be cautious when clicking on links or downloading attachments from unknown sources. These could potentially contain malware or phishing scams.
Don't use pirated software.

Avoid using Peer-to-Peer (P2P) file-sharing programs, keygens, cracks, and other pirated software that can often compromise your data, privacy, or both.

To avoid potential dangers on the internet, it's important to follow these 10 basic safety rules. By doing so, you can protect yourself from many of the unpleasant surprises that can arise when using the web.

386 thoughts on “Live Security Platinum – Virus Removal Guide”

Stelian Pilici

October 26, 2012 at 04:08
Hello Peter,
Yes,this behavior is related to malware.Lets try to fix it.Did you try to use the activation code provided in this guide (AA39754E-715219CE)…If,please try to use this code as it could make the removal process much more easy.
NEXT,download TDSSKiller.zip
- Extract it to your desktop
- Double click TDSSKiller.exe
- when the window opens, click on Change Parameters
- under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
- click OK
- Press Start Scan
  - As we are only looking for a log of what is on the machine right now > choose to skip whatever is found
  - Then click Continue > Reboot now
- Copy and paste the log in your next reply
  - A copy of the log will be saved automatically to the root of the drive (typically C:\)
Next,can you please run a scan with Combofix and Complete Internet Repair utility, and post the logs here so that I can get an idea on what’s going on:
STEP 1 : Run a scan with Combofix
Download ComboFix from the below link:
COMBOFIX DOWNLOAD LINK (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important!Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
STEP 2: Run a scan with Complete Internet Repair utility
1. Download Complete Internet Repair utilityto your desktop
2. Unzip all the files to their own folder on the desktop
3. Within the folder double click CIntRep
4. Select the following items,then press the GO button.
Peter

October 25, 2012 at 21:01

I discovered Windows prevents me from connecting in safe mode
Peter

October 24, 2012 at 22:17

Sir, I was so impresses by your clarity & generosity that I read back to Sept. 1, to see if my problem was already addressed. My Lenovo x300 was infected yesterday (Firefox) and froze. I restarted in safe mode, but can not connect to the Internet because I rely solely on an imbedded Sierra 1x-EV-DO network adapter for broadband connection with Verizon. The device manager tells me it can not start (code 10) and Verizon’s Access Connections is locked to “other” not broadband. Are these problems potentially related to this virus or do I first need a new adapter to clean up?

You really and truly are a hero
David

October 11, 2012 at 19:05

Many many thanks. You are a star!
Eba99

October 6, 2012 at 05:25

Hello Stelian!And Thank you so much!
Whatisu

October 6, 2012 at 03:37

Thanks
Stelian Pilici

October 2, 2012 at 18:05

Hello,
Can you reset Internet Explorer to its default settings and see how that it works: http://windows.microsoft.com/en-US/windows7/Reset-Internet-Explorer-settings-in-Internet-Explorer-9
Andrew

October 1, 2012 at 13:52

IE9
Windows Vista 64-bit

Hi Stelian,

This solution got rid of the virus, very helpful and clear, thank-you!

However, now my Internet Explorer is running very, very slow. It takes a long time to load each page. This did not happen before I followed your steps to get rid of the virus – I am wondering if there is a relation and have you seen this before? Do you have a way to fix the slow IE9?

Steps I followed:
1. safe mode with networking
2. registry fix
3. Rkill
4. Malwarebytes
5. HitmanPro
6. Rogue Killer
7. Kaspersky
8. Eset online scan

Thanks,
Andrew
Tanta

September 30, 2012 at 08:17

Thank you Stelian!
Sarah

September 29, 2012 at 01:38

Hi, Firstly THANK YOU Stellian!!! Excellent very clear instructions and thus far have had no further problems… @King: While it may have worked for you one of the first things I tried was a system restore and the virus stopped me from running the restore (or doing anything else!) It blocked everything, this information was PRICELESS for me! :D
Adele Edwards

September 25, 2012 at 23:13

Thank you for all your help and support
Glen

September 23, 2012 at 23:40

You, my friend, are a lifesaver! THANK YOU! :-)
Dan

September 23, 2012 at 08:31

Perfect! You are a lifesaver.
click here

September 23, 2012 at 08:22

Count me in with a big :THANK YOU!
Brian

September 23, 2012 at 00:32

THANK YOU SO MUCH!!!! I am beyond words in expressing my heartfelt gratitude towards you! I would have lost all my work on the computer without you!! Thanks a million billion trillion!
Chufe

September 22, 2012 at 18:21

Excellent step by step guide, sorted the issue completely.
Thanks Stelian, you are a true star !! :)
Stelian Pilici

September 22, 2012 at 18:18
Hello ,
Lets try to fix your computer,please run the below tools while in Normal Mode;
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
The Guy

September 22, 2012 at 16:29

Thanks!
Alexander

September 21, 2012 at 07:54

Thankyou so much!! this is the second time ive had this virus and i think its because i did not remove it as thoroughly as was done under your guidance. THANKYOU COMPUTER ANGEL!
Eric

September 21, 2012 at 07:03

Thank you so much! You are a life saver!
Pedro

September 21, 2012 at 03:44

Fk… you are the best bro. Thanks for the help. I fkin love you!
Dimitar

September 20, 2012 at 19:22

Thanx a lot for this wonderful guide. A friend of mine has this issue and we succeed to manage it.
Laelaps

September 20, 2012 at 12:34

Thanks for the guide!
I have a problem though… When I start in safe mode it just keeps restarting, it won’t ever load windows, just restarts and says that Windows didn’t shut down correctly, and do I want to start in safe mode, but again, selecting it here causes a reboot, so it just loops. I can start in normal mode.
In normal mode I used FixExec to stop the virus and allow me to run MalwareBytes. I ran a quick scan, and deleted all of the selected issues. I allowed it to reboot, but I was immediately met with the same Live Security Platinum screen and the fake scan that it does.

I have just started a full scan using the method I described above. What else should I do to get rid of the virus? Should I run your other suggestions straight after the malwarebytes scan and fix, without allowing it to restart? It seems like the virus will only start over again if I restart at that point.

Any advice would be greatly appreciated as I have very limited time to get this fixed!
Chantal

September 20, 2012 at 08:05

This was so amazingly helpful. I was in the middle of research for class with typefaces when this happened and completely ruined my whole night. I started spazing and everything. I really appreciate the fact that you have this up for people to use. Greatly appreciate it.
mary

September 20, 2012 at 03:00

Thanks you so much…I followed all the steps listed and it works…you’re such a geek…i can offer you starbucks everyday…it was really a very nasty virus…huhhhh!!!!but thanks God there are blogs like these one….

I think im in love with you…
Stelian Pilici

September 19, 2012 at 13:20

Hello Joel,
Glad to see that everything is running fine…if you have any problems with your machine…We are always here!:D
Joel

September 18, 2012 at 20:18

Holy Crap man….you saved my life. That was one obnoxious bug to deal with, but I followed your instructions (sorta, see next) and everything is running smoothly and no sign of the program.

I used that bogus registration key you provided at the start to the fix and did everything in normal mode. Is that OK?

and….when I ran malwarebytes it didn’t find any malicious program on my computer in the scan. Is that normal?

I did everything else as instructed though and it seems to really have worked! Thanks so much for being so giving with your time and as I see from the comments so willing to respond to peeps using this thread
Stelian Pilici

September 18, 2012 at 12:17
Hello,
Lets try to fix your computer,please run the below tools while in Normal Mode;
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Stelian Pilici

September 18, 2012 at 12:16

Here you go JM- http://windows.microsoft.com/en-US/windows7/products/features/system-restore
Even if you restore your PC to an previous day,you’ll still need to run a scan with the tools from the guide as usually a restore won’t remove the infection…
Good luck!
Stelian Pilici

September 18, 2012 at 12:14
Hello Les,
Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs.
Brian

September 18, 2012 at 10:51

You ROCK!!!! I can never get this type of spyware off of my computer without formatting the hard drive but your method worked! THANK YOU SO MUCH, you have no idea!
morteza

September 18, 2012 at 05:48

thanks a lot , this amazing guide really helped meeee
Les

September 18, 2012 at 04:44

maybe you were lucky but a restore does not guarantee that the virus is removed it could pop up again a few days or weeks later. I would much rather take the time and effort to make certain it is fully removed. besides if I have installed other programms or services they would also be removed and I would waste as much time reinstalling them. What I really would like to know is how it got into my system in the first place and I think I know how. I was doing a search on Google and when I clicked on my search result it did not take me strait to the chosen website but went to another site first just for a split second. )I noticed this in the url box) it then went pack to Google search a couple of seconds later I have the virus coincidence I don’t think so so I experimented on my own site which I know is clean if I went directly to the site no problem but if i searched for the site I got the virus again. it would seem that this particular virus somehow attaches itself to the search engine results I tried a few more searches out of twenty searches I picked up the virus 3 times
Kristy

September 18, 2012 at 01:28

Thank you so much! I totally got hit with this today and now my computer is up and running. I was freaked I would loose all my information. You are wonderful!
JM

September 17, 2012 at 22:52

How do you restore your PC back to two days prior?
JM

September 17, 2012 at 22:50

I have this virus on my PC…same exact pages coming up. When I tried to go in to start the removal as you have noted above, it does not let me F8 to get to the Advance Boot Options to work in safe mode. I did get the Key Stuck error, but when I hit the F8 key, or even hold it down, it still does not take me to the screen so I can start the removal process. Any other suggestions?
ELENI

September 17, 2012 at 20:25

You are my savior!!!! I was just installing a new firmware for my samsung mobile, through my company laptop and this stupid program screwed everything!!
THANKS A MILLION!!!
Paddy

September 17, 2012 at 12:40

Thanks a lot my Hero <3
Stelian Pilici

September 16, 2012 at 07:25

Hello Shane,
No!While in Safe Mode with Networking,Windows will load only the essentials services and process that’s why you don’t see any trace of infection.HOWEVER Live Security Platinum is still there and you need to run a scan with the tools recommended in this guide.
Good lucK!
Nathan

September 16, 2012 at 00:08

Stelian,

I would just like to thank you for your quite exceptional tutorial. It is nice to know that there are still people out there willing to help us non-computer people out here. I’m sure I am not the only one to say that you are an absolute life saver. Thank you so much,

Nathan
Shane

September 15, 2012 at 22:30

I got a question when I restarted my computer “Not in safemode” most of it was already gone, is this from using google chrome in safe mode?
Jade

September 15, 2012 at 22:18

Thank you! This virus is such a problem!
Opie

September 15, 2012 at 18:37

Not only you helped me remove this virus but also other infections that were on this machine!I can’t thank you enough!!
Prisilia Felicia

September 15, 2012 at 15:55

THANK YOU SO MUCH! you save my day!!!!!!
AEM

September 15, 2012 at 04:59

Hi! Stelian…THANK YOU & THANK YOU ^_^
Stelian Pilici

September 14, 2012 at 18:29
Hello Rita,
HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Also this virus has compromised some of your Windows services and we need to fix this:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Stelian Pilici

September 14, 2012 at 17:50
Hello David,
HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Alex

September 14, 2012 at 10:51

Thank You so much Stelian. Your the best!.
juan

September 14, 2012 at 00:18

Muchisimas gracias por aportar cosas como esta, se agradece mucho! eres un crack tio!!
billy sun

September 13, 2012 at 08:04

thank you so much for your help! this worked perfectly.
Rita

September 13, 2012 at 03:19

Thanks a tonneeeeeeee!
I went paranoid after my laptop got infected. You saved me day!!! Can;t thank you enough. I had a few questions:
1. My laptop would switch off after the RKill. So I ran the malwarebytes anti-malware. Thereafter, I followed the rest of the steps. After all the steps were done, I ran the malwarebytes again. Is my laptop safe now? After a while my McAfee stopped working and said that my wirewall is off . I know you suggested McAfee is not such a good program. Thinking my firewall may be off, I did what you suggested.
2. I downloaded the windows repair according to your steps. McAfee is working fine, but when I try to check my windows firewall through the control panel, it gives me the following message: Windows firewall can;t change some of your settings; error code0x8007042c.

Thank you again for the help you are providing to all us people who have no knowledge about how to go about repairing an infected computer. Your guide is awesome.
David

September 13, 2012 at 02:40

thankyou soooooo much u really saved my laptop :) does this remove all viruses as well???
manolid

September 13, 2012 at 00:27

Thank you for this guide. Worked Well.
Ml

September 12, 2012 at 22:13

Thank you, you save My day
Silo

September 12, 2012 at 17:27

Thank you! You’re great. I don’t know you, but I love you! You’ve just made my day :)
Stelian Pilici

September 12, 2012 at 03:45
Hello Mark,
Lets try first to fix this in the traditional way.Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
NEXT,please run a scan with HitmanPro and RogueKiller as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

September 12, 2012 at 03:37
Hello Sebastian,
Your Services service is most likely infected with this virus and this is why you are having this problems.
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Stelian Pilici

September 12, 2012 at 03:34

Hello Jade,
Restoring your computer won’t help you because the virus will still be on your system even after you’ve done this.
I strongly suggest that you run a scan with the tools from the guide but this is after all your choice.
Good lucK!
James

September 12, 2012 at 03:23

As easy as it seems to just do a system retore to a point, it does resolve the issue momentary. Unfortunatly it doesn’t fully remove the virus that embeds itself in your computer. It’s like getting a tick, sure you can just pull it off and leave the head behind, but that may or may not protect you from infections, or issues happening in the long run. You want to ensure that you get that tick out with it’s head intacted, same with any virus that you get. If you just simply restoring the computer you are only putting a bandaid on it, and may be risking a re-infection since it was not properly removed.
Jade Riepenhoff

September 12, 2012 at 02:46

How do I restore my computer to an earlier date?
Brad

September 12, 2012 at 00:50

Thank you so much for taking the time to put this together! It saved all the pictures of my little guys.

Good karma,

Brad
Deana

September 12, 2012 at 00:04

Easylee you saved me from so much work. I did what you said, but deleted it in safe mode so I wouldnot have to hurry. Evertime I went in to see if it was gone it would add another file. Thank you so much it was so easy.
Sebastian

September 11, 2012 at 23:49

Right after i run Rkill, i get a message saying my computer will shut down and since it does, I’m not able to finish the rest of the steps. Any advice?
tim

September 11, 2012 at 14:13

i got every thing working. thank you for the guide. :)
Alex

September 11, 2012 at 05:57

This tutorial has helped me save 2 machines in 2 days. Thank you.
Mark

September 11, 2012 at 00:37

I need help. I have this problem and this is so confusing and I don’t understand computers very well. Can someone help me via teamviewer or something itd be so great. What can I do to make it worth your while?

Please email me
Ryan

September 10, 2012 at 21:35

Thank u so much that was the best advice I’ve ever gotten. I have a degree in mechanical engineering nd not computer science but thank u again! And for me to trust someone’s words on the internet too!
tim

September 10, 2012 at 17:51

i just retried uninstalling chrome but i got the error “windows cannot open this file: file: rundll32.exe”
tim

September 10, 2012 at 17:46

i tried that but i have no internet browser at all, i can’t open any program, even ones from my external hard drive. the only program i have been able to open was nvidia control panel. did i mess up my registry?
Stelian Pilici

September 10, 2012 at 17:32

Hello Tim,
Uninstall,restart and then reinstall back Chrome.If you are still having problems than reply back!:)
tim

September 10, 2012 at 17:23

Hi, i ran through your guide but i think i screwed something up, after the reboot my system started and i was able to use google chorme, but when i came back and started it again all programs, (i’m assuming all .exe), will not load. i get the message to try and start program with web service. any advice would be much appreciated.
Stelian Pilici

September 10, 2012 at 12:48

Hello chloe,
Your Combofix log shows that you’ve still got some infection on this machine.Can you please start a thread in our Malware Removal Assistance forum as we need to remove this viruses.
Stelian Pilici

September 10, 2012 at 12:45
Hello Kah,
Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :
STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Additional notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Now,let try to repair your computer:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Stelian Pilici

September 10, 2012 at 12:38
Hello D,
That’s not a problem as long as you’ve managed to run a scan with Malwarebytes and the other tools.
As an additional steps I can recommend that you run a scan with :
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Stelian Pilici

September 10, 2012 at 12:34
Hello Tuan,
Yes, if you are having problems with the Windows updates then you need to re-register your BITS service.
If you didn’t back-up any files that ended in a .exe extension then you don’t have any reason to worry.
As far as Combofix goes,this tool is very good and can help me understand what’s going on however if you don’t want to do this steps is totally up to you.
I can recommend that you run a scan with Kaspersky Virus Removal Tool:
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
Good luck!
Stelian Pilici

September 10, 2012 at 12:25
Hello Jennifer,
Did you run Rkill before trying to run Malwarebytes?
Can you please follow this steps:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Tuan Taureo

September 9, 2012 at 19:54

Allow me to impart my most sincere appreciation to your simple suggestion of using the local system restore function, King. I just did that and lo and behold, I now have a working Windows Defender firewall, Windows Update and Security Center again.

My hat goes off to you.
Tuan Taureo

September 9, 2012 at 19:52

Well look at that. I did a system restore back to Tuesday this week where I had performed a Windows Update, and that solved it. Thank you nevertheless for your article, as it did help me regain control over my computer to start with.

I will definitely surf much more safely from now on …
Leslie J.

September 9, 2012 at 19:34

Thank you so very much! I’m computer illiterate and your step by step guide is clearly idiot proof! Thank you again, kind soul!
EasyLee

September 9, 2012 at 16:50

Clearify: for me the virus was stored inside a folder located in the “ProgramData” folder… ProgramData/547643765735896958/live.exe
delete the “547643765735896958” …then do a system restore… and “547643765735896958” is just a made up folder name and live.exe is just made up name… you have to determine YOUR virus location by left clicking on the shortcut that the virus creates…. the left click on shortcut-select properties – open file location… and that location is the folder that needs to be deleted.
EasyLee

September 9, 2012 at 16:31

the method to kill this virus is way to long and there is a more simple way to kill this nonsense…
1.) This virus program program will create a shortcut, left click on it and select properties
2.) Open file location, which will take you to the folder where the virus application is stored… make a note of the folder location (for me it was “ProgramData” folder…
3.) You will not be able to delete the virus folder immidiately because it launches itself and as u should know you cannot delete a folder or program that is being used… you have to delete it before it has a chance to launch… so shut down your computer.
4.) start your computer, and as soon as you are able – go directly to the folder that has the virus application and delete the application before it has a chance to launch itself
5.) restore your computer to an earlier date (this restore will repair registry)
Jennifer

September 9, 2012 at 03:41

When I try to download Malwarebytes, I check both options and it says Acces denied, and rolls back. Now what?
Tuan Taureo

September 8, 2012 at 18:46

So far I’ve been running HitmanPro, Malwarebytes Free and RogueKiller repeatedly (along with two ESET scans). Shortly after I finished the steps in the article above, I ran the ESET scanner as suggested in comments below mine and that discovered an additional number of trojans that I let it quarantine and remove. Since then, RogueKiller has found one more suspicious registry key (about a day after the fact, when the other two antimalwares were checking out clear), but other than that, none of my current malware removers (Malwarebytes, HitmanPro, RogueKiller and a successfully reinstalled Microsoft Security Essentials) have found anything malicious.

I have however discovered that I’m missing the Background Intelligent Transfer Service and Automatic Update entries in the services.msc list, and this has already proven to cripple my Windows Update (even though I – seemingly – had restored it with Microsoft’s Fix it tool).

Personally, I have to admit that I’m finding that ComboFix software rather volatile of a software to use, judging from your instructions. I have just finished another ESET scan, and it’s coming up clean. Should I attempt to use the cmd command to restore the BITS function and run that repair tool at the end of your suggestion?

Finally, one more question:

Shortly after I finished the last step of this guide, I made a manual backup of most of my personal files – very nearly exclusively MSOffice documents and files, image files of the standard varieties, PDF documents and .txt files. I performed this backup through the old copypaste technique, copying the relevant folders in groups onto the harddrive and letting them overwrite the previous backup. My question is this: is there any possibility of the various malware components associated with this virus having embedded themselves somehow into my “My Documents” directories?

(I ask this question in the event that I might end up having to perform a full system restore and wipe my harddrive anyway.)
Pia

September 8, 2012 at 15:24

THANK YOU SO MUCH!!!! This problem was driving me mental and your steps were really easy to follow. You saved my day!!!
D

September 8, 2012 at 13:41

Thanks for your guide, it really works.
question: I skipped step 4 (Rkill) because I couldnt run it (also using th several different links provided). Is this a problem?
Kah

September 8, 2012 at 13:34

Update. I did update my Internet settings back to default and was able to get Internet after disabling windows firewall and other internet security. Now how can I restore to use Internet with firewall and security being enabled.
Stelian Pilici

September 8, 2012 at 04:18

Hello Lana,
I advise to avoid McAfee isn’t that great when it comes to zero day malware prevention!
Below you can find some quick suggestions on what security products I would recommend:
Free – Avast 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012,Avast Internet Security 7,G-DATA Internet Security 2012 or ESET Smart Security 5.
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layered security config: http://malwaretips.com/Forum-Security-Configuration-Wizard

Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
Stelian Pilici

September 8, 2012 at 04:15

Hello Al,
Yes,you can uninstall all the utilities that we’ve used.
Stay safe!
Al

September 8, 2012 at 01:41

After I’ve removed Live Security Platinum, can I remove the programs that that were installed during these seven steps?
chloe

September 8, 2012 at 00:33

here is the log, i followed the steps and eset scanner found 8 threats, but my computer still freeze after i start my laptop 5-10 mins

ComboFix 12-09-07.03 – Chloe 2/09/07 周五 17:48:25.1.4 – x64 NETWORK
Lana

September 8, 2012 at 00:21

Stelian,
Thank you for your help thus far. I am convinced that security platinum has been removed. The FBI ransomewre has been removed. One last virus: EnCiphErED This is what is stopping me from opening my files. I am not able to download the McAfee I purchased. Something about temporary files. Help!
Kah

September 7, 2012 at 23:56

I have run everything original fixes step by step as well as gone as far as eset Kasprisky every program seems to remove fragments of virus but still can not open ie in normal mode
Sam

September 7, 2012 at 20:50

Okay, I’m going to try this in a few.

Thanks for the response.
NA

September 7, 2012 at 16:04

Thank you for posting this information. Thanks again……
Gary

September 7, 2012 at 15:39

This is fantastic. Thank You so much for going out of your way to help with this. It worked terrifically.
Stelian Pilici

September 7, 2012 at 15:14
Hello Joe,
If there is no proxy then this is great…Now I’ll need a log to see what’s going on:

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Additional notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for the logs and details on how the machine is working…
Stelian Pilici

September 7, 2012 at 15:12
Hello Cory,
You can ignore that alert…Internet Explorer has displayed that alert because this file isn’t commonly downloaded …
Also:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
–
Stelian Pilici

September 7, 2012 at 15:11
Hello John,
We can manually remove this files however let’s see if we can get rid of some of them using the below software:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
NEXT,please re-run a scan with HitmanPro and post the log or a screenshot here and I’ll give you instructions on how to remove the left over files.
Good luck!
Stelian Pilici

September 7, 2012 at 15:09

Hello Patrick,
Can you please download Comodo Cleaning Essentials and start KillSwitch….We are looking for any files that aren’t safe…
I need a screenshot from this utility if possible.
Stelian Pilici

September 7, 2012 at 15:07
Hello chris,
You can ignore that alert…Internet Explorer has displayed that alert because this file isn’t commonly downloaded …
Also:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
–
Stelian Pilici

September 7, 2012 at 15:04
Hello chloe,
Can you please run a scan with Combofix and ESET online scanner and post the logs here so that I can get an idea on what’s going on :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

September 7, 2012 at 15:04

Hello Matt,
Did you try to re-register the BITS service?
Stelian Pilici

September 7, 2012 at 15:03
Hello,
Can you please run a scan with Combofix and ESET online scanner and post the logs here so that I can get an idea on what’s going on :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

September 7, 2012 at 15:01
You can ignore that alert…Internet Explorer has displayed that alert because this file isn’t commonly downloaded …
Also:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
–
Stelian Pilici

September 7, 2012 at 15:00
Hello bobby,
You can ignore that alert…Internet Explorer has displayed that alert because this file isn’t commonly downloaded …
Also:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
–
Stelian Pilici

September 7, 2012 at 14:58

Hello,
You should run a scan with Malwarebytes and HitmanPro just in case….. :)
Stay safe!
Stelian Pilici

September 7, 2012 at 14:50
Hello Tuan,
Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :
STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Additional notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Now,let try to repair your computer:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Tuan Taureo

September 7, 2012 at 12:57

And then it’s gone … and now I’m stuck with a disabled Windows Security Center. -_-

(Sorry about the comment spam, I’m very frazzled right now.)
Tuan Taureo

September 7, 2012 at 12:39

And now it’s yelling about a ZeroAccess thing. o_o
Tuan Taureo

September 7, 2012 at 12:34

Okay, herpaderp ended. Managed to figure out how run RogueKiller anyway.
Tuan Taureo

September 7, 2012 at 12:16

I will likely need it, since I have yet to successfully reactivate my Microsoft Security Essentials (I think it’s claiming to not be installed …?)
Tuan Taureo

September 7, 2012 at 12:02

Following these instructions now. Unfortunately my SmartScreen filter is preventing me from getting the RogueKiller.exe. What do?
King

September 7, 2012 at 02:24

I simply restored my system back 4 days before this problem and that seemed to take care of the problem, without having to go through this long process. So, I wonder – why don’t you just recommend restoring back before the Live Security Platinum?
Mark

September 7, 2012 at 02:04

Steven, Thank you for the invaluable assistance . I was starting from a point of being unable to run any .exe and receiving continuous bogus alerts. Your instructions were excellent and all issues appear to be resolved.
Logan

September 7, 2012 at 00:34

Thanks , sooooooo much. I was working on a project for school for 2hours and all the sudden the virus pops up. I begin serching on the internet (amazingly it still worked) and found this page followed the steps and my computer is running great.! I also installed nortan security. THANK YOU!!!!!!!!!!!!!!!!!! :-)
bobby

September 6, 2012 at 23:25

When I try to download rougekiller my computer tells me it’s unsafe to downlad and has been blocked by smartfilter
Matt

September 6, 2012 at 23:21

Really? So because you don’t realize that this guide pretty much uninstalls the firewall you’re just going to ignore my comment? Hey every one, when you finish every step in this guide, it uninstalls your windows update service, your windows firewall service and your security essentials service. The “Fix all in one” program does not fix this issue. You can easily reinstall security essentials, but in order to repair your firewall and windows update you have to reinstall windows.
Yasmine

September 6, 2012 at 22:16

Whenever i try to download the Roguekiller it says that Smartscreen filter has blocked it and claimed it was a malicious program.
Thanks for the reply

September 6, 2012 at 21:30

Thank you so much for the reply!

I’m a bit confused because the description says that Chameleon helps install Malwarebytes Anti-Malware, it gave me 12 links but none of them worked, however Malwarebytes Anti-Malware is already installed on my computer (I downloaded it last night after RKill failed to stop anything and I posted that comment). Last night Malwarebytes scanned and detected 12 threats which it destroyed, and after the reboot the Live Security Platinum icons were removed, which I suppose is a good thing.

HitmanPro then came, but instead of the large number of threats that were found in the guide, it only found 1 actual threat, which it removed. I then re-ran it and found nothing.

Then after that last night I ran Rougekiller and again, instead of the many in the guide only 1 threat was found. I deleted it, re-ran it again and this time found nothing.

However, my Firefox now seems to be hit with this annoying redirect bug that sometimes redirects it to random sites.

Can you please tell me if the virus is gone? Because all the tools in the guide found less threats than they were supposed to plus the redirecting virus.

Thanks again.
chloe

September 6, 2012 at 21:29

hi, I just got the live security platinum virus yesterday, and then i followed ur steps, and it was fixed. however when i turn on my laptop today, i can open any programs, but after a while, all the programs are freeze and do not responding, do you have any idea why?
Stelian Pilici

September 6, 2012 at 17:55

Hello Sam,
Don’t worry,if you follow this steps LSP will be gone.
Good luck!
Stelian Pilici

September 6, 2012 at 17:54
Hello Timothy,
Can you please run a scan with Combofix and ESET online scanner and post the logs here so that I can get an idea on what’s going on :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

September 6, 2012 at 17:52
Hello,
Please follow this steps:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Stelian Pilici

September 6, 2012 at 17:51
Hello Fazrezal,
Please follow this steps:
STEP 1: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
STEP 2: Repair Background Intelligent Transfer Service service
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

STEP 3: Remove the residual damage from Live Security Platinum
Download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Repair Windows Updates
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Restart your computer and see if your everything works!
Paul

September 6, 2012 at 17:32

THhis worked awesome. THank you so much for doing this simple step-by-step. Worked great
Fazrezal

September 6, 2012 at 12:50

Hello, thank you very much for this help. I was about to panic when this virus infected my laptop. Everything was going on fine, but my firewall cannot be turned on. I did some steps that I found on the comments above such as using the windows all in one repair, but it still doesn’t work. Can you give some help?
HELp me

September 6, 2012 at 09:37

RKill says no malware found to kill and no stop etc etc but the Live security IS on my computer. Now what do I do?
Chelsey

September 6, 2012 at 04:41

OH MY GOODNESS!!! You are the nicest guy ever to leave this here… I was absolutely pannicking.

thanks so much

Chelsey
Matt L

September 6, 2012 at 04:29

I freaking love you
Wag

September 6, 2012 at 04:07

Thanks bro, I really appreciated. Keep up the good work. I followed all your instructions it worked great. I took almost 3 hours deleting different files, but you hit it right on the head. One shot one kill.
Dean

September 6, 2012 at 04:04

Thanks again Stelian! My laptop wireless connection is restored.

From your last message, I had to get the Symantec AV turned off before running the scans you recommended. Since the company has our AV locked down and I was reasonably certain that the AV or was part of the problem, I had the AV striped off the laptop and then tested the wireless connectivity. With out the AV, the wireless was restored. Now with a fresh install of the AV, I’m back in business. Many thanks again for all the advice!!!
SJaved

September 6, 2012 at 03:47

Thank you for describing in an easy way to deal with this problem.
Timothy McClain

September 6, 2012 at 03:28

I have completed all the steps and got rid of the virus, but when I try to go into normal mode, after about a minute, my computer freezes up. I have a Lenovo B570 Intel i3 computer with Windows 7 64-bit.
Sam

September 6, 2012 at 03:23

Hi Mr. Pilici,

The LSP infected my primary computer tonight, and I’m reaching your site here by hooking up my secondary back-up comp. I’ve manually transcribed your above 1-7 steps for eliminating this god-awful virus.

From the comments above, I have confidence it will work. I’m somewhat of a comp novice, so bear with me. When I start out in Safe Mode Networking and push ‘ENTER’, does my comp then go to a normal screen or login where I can then download all the programs you list to remove LSP?

And how would I get to your convenient download links on this page if I were using my infected primary computer? Won’t LSP stop me from getting here in the first place?

Do I just google say, “RogueKiller downloads” to get it and the others? Thanks for your help, I hope you can answer my questions before I hook my sick comp back up to the internet and try your steps. I’ll check back tomorrow night, 9-6-12 with my back-up here.

Again, thanks a bunch. If this works, you will have saved me a bunch of money, time, fear, and hassles!
Maya

September 6, 2012 at 02:35

Cant tell you how much I appreciate everyhting.
This has been a nightmare that I thought will never end.
Thank you so much!!!
Keep doing the great work that you do. So happy right now!
Thank you,
Maya
Matt

September 6, 2012 at 02:16

Hello, I did this guide step by step, and it worked. When it finished, some issues with security essentials, my firewall, and windows updates had started. All three of them keep saying that the service isn’t running. I tried the method you suggested to Gregory, and that didn’t work either. Any other suggestions?
katietx

September 6, 2012 at 02:14

THANK YOU SOOOOO much for posting this. It was a long process BUT I got my computer back!!! YOU are fantastic!!
chris

September 6, 2012 at 01:04

Thankyou very much, I ran through to stage 6 and everything seems ok, I tried stage 7 but my computer won’t let the site load, apparently it’s deemed too risky. I would like to run it to be safe but don’t know how.

Again thanks for your time and effort.
Patrick

September 5, 2012 at 23:28

Combofix got stuck on stage 4 and did not complete. ESET scan got stuck on a temporary internet file, which is where the malwarebytes scan also gets stuck. I double checked my settings after running combofix and realized I did not turn off Windows Firewall. Should I turn the firewall off and try running Combofix again?
A JOHN

September 5, 2012 at 22:31

Perfect way to get the stuff out ! was a great help and thanks.
John

September 5, 2012 at 22:17

Hi, I have been following your steps, which are clear and so far appear to be working. I downloaded hitmanpro as you suggested, ran scan and was looking for the free trial as you highlight but there is no click through, on,y buy now. It appears it is an updated version ie hitmanpro 3.6.1 build 164 which differs from your screen grab. It found 13 threats, but I can’t remove these unless I buy the software. Please help. Is there another product or way around this? Thanks. Your blog has been really awesome, you are great for the web. J
Randall Ware

September 5, 2012 at 21:14

Stelian,
Thank you so much for your generous help, and the very detailed and helpful instructions.

Randall
Cory

September 5, 2012 at 21:06

so i’ve been going through the process of removing this virus, and when i go to download roguekiller, smartscreen filter blocks it saying the website is known for having malicious software…

any suggestions?
Joe Rando

September 5, 2012 at 20:08

I, like many others have caught this virus. I began following your steps and when I went to uncheck the proxy in LAN settings noticed it was already unchecked. I am currently on a friends computer to find this page and thought I’d try the next step on mine since it was unchecked and when I searched the web to try and get Smart Fortress I was getting sent to bogus sites (must be still infected). Is there anything I can do? I am in safe mode where all icons are over sized and windows help and support open.. Please and thanks for your help!!!
Pat

September 5, 2012 at 20:00

Okay, I ran the all in one repair again. This time I checked only firewall repair, and restore windows services and the firewall is now on. Thanks very much for this great set of instructions. You saved me!
Pat

September 5, 2012 at 19:02

Dear Awesome Sir:
I think I am almost there on a windows 7 laptop. However, I’ve done all the steps and finished windows all in one repair, but still I can’t turn on the windows firewall.
I try to start the windows firewall service and I get an error: “1068: the dependancy service or group failed to start”
Osman

September 5, 2012 at 05:50

Thank you, so much. This virus sucked, had no idea it was so comprehensive. Really appreciate all the kind work that went into making this guide – you’re awesome.
Stelian Pilici

September 5, 2012 at 04:06
Hello Sacrus,
Can you perform a scan with the following utilities:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Stelian Pilici

September 5, 2012 at 04:04
Hello Gregory,
Please follow this steps:
STEP 1: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Now,let try to repair your computer:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Repair Windows Updates
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Gregory

September 5, 2012 at 00:26

Stelian after following your guide to the letter i believe i have removed the virus. But for some reason i can’t run Automatic Updates nor update my Microsoft Security Essentials? (I have tried reinstalling)
Any tips for that or should i look in forums?
King

September 5, 2012 at 00:22

That’s exactly what I did too. I simply restored my system back 4 days before this problem and that seemed to take care of the problem, without having to go through this long process. So, I wonder – why don’t you just recommend restoring back before the Live Security Platinum?
John

September 5, 2012 at 00:20

YOU ARE AWESOME!!!!!!
Sacrus

September 4, 2012 at 22:37

Hello. First of all. thanks for your tutorial…
Just to say one thing: I don’t know if it is only my problem, but i downloaded the hitman pro, and i don’t find a way to activate for 30 days evaluation… I have to find a crack, and then run de scan…
Everything else, 100% OK.
Beth

September 4, 2012 at 22:12

THANK YOU SO MUCH. You saved my @$$.
Tim

September 4, 2012 at 21:21

As the great Charlie Sheen would say, you are WINNING! Seriously, thanks for the help. Every single step was perfectly clear and my PC is 100% back to normal again!
Matte

September 4, 2012 at 18:32

Thanks so much for the clear and thorough instructions. This saved me a lot of time and a great deal of worry and hair-pulling! Any other time I had a virus I had to wipe my hard drive – ugh! Thanks for generously sharing your knowledge!
Stelian Pilici

September 4, 2012 at 08:57
Lets get rid of this infection:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Anita

September 4, 2012 at 06:57

Hi There,

Many thanks for your help. This was a nasty virus and the instructions were fantastic.
Keisha

September 4, 2012 at 06:40

Hi. I’m on step 5 where you’re supposed to download the malwarebytes thing but when I click the link it and the page pulls up it doesn’t give me the option to click on what is instructed. It just says download and when I click that it takes me to a cnet thing and doesn’t do anything.
Stelian Pilici

September 4, 2012 at 04:43
Hello Stephanie,
HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:

1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, close the program
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Stelian Pilici

September 4, 2012 at 04:41
Hello Dean,
Can you please run a scan with Combofix,Complete Internet Repair and Farbar Service Scanner so that I can get an idea on what’s going on :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with Complete Internet Repair utility
1. Download Complete Internet Repair utilityto your desktop
2. Unzip all the files to their own folder on the desktop
3. Within the folder double click CIntRep
4. Select the following items,then press the GO button.
STEP 3: Run a scan with Farbar Service Scanner
1. Download Farbar Service Scanner from the below link.
  FABAR SERVICE SCANNER (This link will automatically download Farbar Service Scanner on your computer)
2. Run the ulity and checkmark all the boxes
3. Click on the Scan button.
4. Add the log that will produce in your next reply.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

September 4, 2012 at 04:29
OK Patrick,lets bring in the big guns:
Please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Dave

September 4, 2012 at 04:28

The whole thing worked without a hitch, thanks for the detailed instructions.
Sarah

September 4, 2012 at 04:05

Thank you so much! I was in a near panic when that virus popped up. Did a quick search on my iphone and found this tutorial. I followed all the steps and everything worked fine! My computer is fixed. I honestly can’t thank you enough. You’ve saved me so much time and money!
Michael

September 4, 2012 at 04:04

Thanks so much! Everything seems to be going good, at malwarebytes step.
Patrick

September 3, 2012 at 22:29

Ran both HitmanPro and Roguekiller and followed the instructions as posted here. Malwarebytes is still running for about 5 minutes and then it stops responding.
Andrew

September 3, 2012 at 22:28

Thank you so much for your time and effort. This is the most helpful guide ive seen pertaining to the removal of malware. You even took the time to put the links to download software and reply to peoples questions.

truly amazing
Dean

September 3, 2012 at 20:00

Thanks for the excellent advise!!! The desktop computer that was attacked by Live Security Platinum, and shut out of the Internet, is now restored after working through your suggestions. The protocol order was followed but since internet access was not restoted until after RogueKiller.exe was run, I had to back track and re-run Hitman Pro. The attack was so nasty that it impacted our router as well. Two PC laptops also could not access our wireless network untill the desktop computer, also on a wireless connection, was restored. Unfortunately, my office laptop will still not connect to the internet, either wirelessly or even when directly plugged into the modem. There seems to be something actively shutting down the connections, which are listed as “connected” for a few seconds before the connection fails again. This only started with the attack on the desktop computer and the laptop has been scanned for the Live Securety malware without it being dected. Any advice would be greatly appreciated!!! Thanks in advance.

Dean
Stephanie

September 3, 2012 at 19:25

I have done everthing up until the rougekiller download, my computer wont let me download it and when it tries it tells me that there is an error in red. Will everhting be okay with out the last steps?
Manish Kumar

September 3, 2012 at 16:34

RogueKiller found nothing but ESET found one threat and removed it.

Below is from ESET:
C:\Users\manish\AppData\Local\temp\hdD50A.tmp a variant of Win32/Kryptik.AKYH trojan cleaned by deleting – quarantined

Thanks a lot for your help in removing thhe threat and making my PC safe. It is very easy to follow and sorted it out perfectly. You are an absouloute Star!
Janice

September 3, 2012 at 14:05

Thank u soo much. I almost threw my laptop out the window in the middle of a 20 pg research paper. You saved me a lot of money!!
Stelian Pilici

September 3, 2012 at 12:24
Hello giannis,
Lets work in NORMAL MODE to avoid this issue:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Stelian Pilici

September 3, 2012 at 12:23

Hello Patrick,
Please run the HitmanPro and RogueKiller scan and then try to do a Full scan with Malwarebytes…
Patrick

September 3, 2012 at 09:16

I’m at the step to run Malwarebytes but everytime I run the full scan, the program stops responding about 5 minutes in. I used malwarebytes chameleon and that worked along with the quick scan that followed. What do I do to get the full scan to work properly?
giannis

September 3, 2012 at 07:49

Hello,
I’ve stuck at step 4. I have downloaded RKill, but when i click it, Internet Explorer opens instead of the cmd.
Help me please
J. Johnson

September 3, 2012 at 06:46

5 stars, good shit man
Bobby

September 3, 2012 at 02:05

Hitman Pro seems to have been updated so there is no free version. Rogue Killer caused a blue screen error on my PC. I skipped these two steps, and so far so good. Thanks all.
Stephanie

September 3, 2012 at 01:10

Just wanted to say thank you for all the info! Everything appears to be working on my computer and all the Live Security stuff is gone. You saved all of my precious photos and saved me money! THANKS SO MUCH!
TW

September 2, 2012 at 23:15

Worked perfect. I could not use my internet(till you showed how and then I was able to perform all the steps-1.5 hrs), or restore. This cleaned it all out. Very much worth the effort. Thanks.
amanda

September 2, 2012 at 22:58

AWESOME! AWESOME! AWESOME! I don’t really know much about computers and I’m somewhat known by the local PC fixers as a little too click happy… This looks like a more difficult fix than it actually is… However, after going into safe mode with networking and downloading the malware program, it was just a few clicks to delete that awful “security” thing!!! Thank You!!!
anand

September 2, 2012 at 17:54

Great stuff, it helped me to remove torjan
Sammy Dayoos

September 2, 2012 at 17:23

Thank you so much man. It was awesome!!

It is nice to see good people like you dedicate their time helping others.

This saved me lots of money.
Oswin smith

September 2, 2012 at 16:55

Thank you soo much!
I was considering on taking my computer to a PC Repair shop, but your website made that totally unneccessary and a waste of money.
It helped me, a person with little knowledge of IT, to remove that annoying and pesky virus that is very persistant.
I am so grateful for this website and your Guide, so keep on trying!
Thanks again.
Alex

September 2, 2012 at 13:24

Thank you! clear and welldone.
Godfrey Williams

September 2, 2012 at 11:28

Just to say thank you and to encourage others to use your fix and not to be intimidated by the process. Your clear instructions and screenshots make the virus removal idiotproof – and I should know!
Lara

September 2, 2012 at 05:53

Awesome! I ALMOST put in my card information before i decided to google what this silly ‘live security’ was. Thank You!!!!!!!!!!!
RANDALL

September 2, 2012 at 03:29

Stelian, top job mate. Followed your easy step by step method and viola!!….gone. Greatly appreciated like so many have mentioned above me.
cabe

September 1, 2012 at 22:37

WOW! I am considered quite the tech nerd but you my friend are a jedi master. Amazing step by step info and you saved me alot of time and headache. I salute you sir.
Stacey

September 1, 2012 at 22:21

Thank you sooooo much…this step by step guide is so easy to follow and has saved my laptop. you are my hero thank you again! xxx
bryan

September 1, 2012 at 10:57

This is well done. Thank you for taking the time to help everyone out! Thank you!
Sue McCarron

September 1, 2012 at 04:57

THANK YOU!!! You saved me $75…and I was initially intimidated by all the steps, but I figured it can’t HURT to try! I’m so thankful. God Bless You for putting this together with the links and sharing it…I’m a single mom on a VERY tight budget, and that $75 I saved represents entertainment trips for my kids that we would have needed to skip otherwise!! Sue
Theo

September 1, 2012 at 01:20

Excellent post! It saved my computer, thank you very much!!
Stelian Pilici

August 31, 2012 at 17:53

Hello momotyan,
Here is how you can create your own registryfix.reg :

1.Create and run your registryfix.reg

A.Copy all the text in bold below and paste to Notepad/Text Document

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.exe\shell]

[-HKEY_CLASSES_ROOT\.exe\DefaultIcon]

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”

[HKEY_CLASSES_ROOT\exefile]
“Content Type”=-

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”
“IsolatedCommand”=-

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
“IsolatedCommand”=-

[HKEY_CLASSES_ROOT\.bat]
@=”batfile”

[HKEY_CLASSES_ROOT\batfile\shell\open\command]
@=”\”%1\” %*”

[-HKEY_CURRENT_USER\SOFTWARE\Classes\.exe]

[-HKEY_CURRENT_USER\Software\Classes\exefile]

[-HKEY_CLASSES_ROOT\secfile]

[-HKEY_CURRENT_USER\Software\Classes\secfile]

[-HKEY_CLASSES_ROOT\pezfile]

[-HKEY_CURRENT_USER\Software\Classes\pezfile]

[-HKEY_CLASSES_ROOT\sezfile]

[-HKEY_CURRENT_USER\Software\Classes\sezfile]

[-HKEY_CLASSES_ROOT\ah]

[-HKEY_CURRENT_USER\Software\Classes\ah]

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
@=”firefox.exe”

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command]
@=”firefox.exe”

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@=”iexplore.exe”

B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)

C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.

NEXT,follow the guide to remove the malicious file from your computer.
Good luck!
David

August 31, 2012 at 17:51

Thanks! It worked!
Damn It

August 31, 2012 at 13:18

<.< I kinda threw my laptop out my window on a 6 story building in rage. Wish I thought to go here first.
momotyan

August 31, 2012 at 08:49

Hi,

I am at step 3 trying to download the registryfix.reg. I am using firefox. After I click save, there isn’t any prompt to run anything, and the .reg file doesn’t live on the C drive when I did a search for it. Could you please let me know how to proceed in firefox? My internet explorer keeps crashing so I don’t think IE is an option for me.

Thanks!
Stelian Pilici

August 31, 2012 at 05:54

Hello Keny,
Can you please run RogueKiller,remove any detected threats , restart your computer and then try to run the HitmanPro scan….
Waiting for your reply to tell me how everything worked out..
Kent

August 31, 2012 at 00:35

Hey, I’ve had no issues up until hitman. IU’m getting “Firewall software may be blocking hitman” or some similarly phrased error. I’ve looked all over and can’t find anything blocking it…?
APK

August 30, 2012 at 18:11

Seems to have worked for me! Thanks!
Arnie

August 30, 2012 at 06:13

Thanks, managed to sort out problem very quick with this guide!
Jersey Mom

August 29, 2012 at 21:04

Thanks so much. I got infected today and thought my computer was dead. I am so appreciative of the easy, step by step directions provided by this great website. By the way, I traced this virus back to an email link sent from the USPS/UPS (both links were on the same message) writing that a package I had sent could not be delivered. I was totally taken as I had just sent a package via UPS. Lesson learned.
Max

August 29, 2012 at 17:40

This really worked quite well, great job, many, many thanks.
Stelian Pilici

August 29, 2012 at 16:10

Hello Lim,
You can download the 3 software from the guide and just do a scan.. it won’t hurt… I’m saying this because I really doubt that LSP is really gone from your computer.
Colette

August 29, 2012 at 15:43

Wow! It worked great. Thank you so much!! The detailed instructions really helped.
Lim

August 29, 2012 at 09:44

Got infected for a few days but it seemed to have suddenly disappeared. The warnings are gone and there’s no more icon on the taskbar. It has vanished from the all programs list. I haven’t been doing any cleaning or scanning. Just wondering if the “Live Security Platinum” just disappeared without me doing anything or it’s still somewhere in my system.
jesse

August 29, 2012 at 02:43

thanks
Clare

August 29, 2012 at 02:41

thank you. thank you. thank you!!!!!!!!!!!
Laserman

August 28, 2012 at 23:19

I tried several things to get rid of this virus and this guide was the only thing that worked. Thanks a ton!
Beckernet

August 28, 2012 at 20:51

Some great tips for me to read here. But after looking at some steps required to remove the virus I decided to restore my computer to an earlier point (2 days earlier) and that seemed to take care of Live Security Platinum with the least amount of effort.
Joe

August 28, 2012 at 18:24

Thank God for people like you!
kieren lee

August 28, 2012 at 14:56

just finished eset and now the laptop is running great thanks for your help your a life saver !!!
kieren lee

August 28, 2012 at 13:53

hiya im currently running through the eset online scanner thanks for your help ill let you know how it goes
Manish

August 28, 2012 at 13:04

Thanks a ton..Your tips and steps helped me fix my pc!! :)
Sophie

August 28, 2012 at 09:48

thank you :)
Liam

August 28, 2012 at 02:29

Just writing to update my previous post….I was able to rid the live security platinum from my computer. I failed to enter the authorization code in order to simplify the removal process as you mentioned, and therefore still couldn’t access the internet. After entering the code, I was able to access the internet and finish the above process. Thank you for providing a thorough and simple process with step-by-step directions.
Liam

August 27, 2012 at 23:41

I have followed the post and directions…now on my second turn (still having issues after my first reboot). When installing Malwarebytes Anti-Malware I encountered the message:
“Error creating registry key:
HKEY_CURRENT_USER\Software\\Malwarebyes’ Anti-Malware

RegCreateKeyEx failed; code 5.
Access is denied.

Click Retry to try again, Ignore to proceed anyway, or Abort to cancel installation.”

I clicked on Retry the first time and it was never able to successfully go through, so I hit “Ignore” and followed the rest of the directions…perhaps this is why it did not work?? Any help would be much appreciated.

I am on the second go around and don’t want to go through again. After I hit “Ignore” I was able to run the Malwarebytes and it detected numerous objects and removed them, however, upon restarting Live Security Platinum was ready to greet me, and I still could not access the internet (firefox) in normal mode. Thanks again.
Sheida

August 27, 2012 at 22:30

I was scared when i saw this malware alarms on my screen. But your tips saved me! Thanks a lot.
Stelian Pilici

August 27, 2012 at 18:47
Hello kieren lee,
Lets work in NORMAL MODE to avoid this issue:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
kieren lee

August 27, 2012 at 12:37

Hiya my mum currently has this virus but every time I load safe mode with networking it loads the home screen then completely shuts off please help as I can no longer do anything on the laptop till this is solved
Ian Sayers

August 27, 2012 at 10:10

Many thanks. Your clear and accurate instrutions allowed me to fix my wifes computer.

Your an absouloute Star!
Phil

August 27, 2012 at 09:30

Thanks so much for this – very easy to follow and sorted it out perfectly.
Stelian Pilici

August 27, 2012 at 03:56
Hello Kumar,
The HitmanPro log looks good…..those cookies are harmless….
As an additional step, you can run the following steps:

STEP 1: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Stay safe!
Manish Kumar

August 27, 2012 at 01:08

Hi,

Malwarebytes run successfully and removed several viruses from my PC.
Hitman Pro displayed that there were 55 traces found but no threats on my computer and at the end when I proceeded to delete it displayed message “Delete Failed” for every cookie.

Everything now is running fine in my computer but not sure if “Delete failed” for those cookies will have any impact on my system.

Please suggest.

Please refer the HitmanPro Logs at following link.
htxps://docs.google.com/open?id=0B6WRmbnqyjZ4QUtMbnBUOFpHU1k

Many thanks in advance.
dyneris

August 26, 2012 at 18:27

thank you :)
orhan

August 26, 2012 at 10:08

very thanks for your helps. this is really helpful
Stelian Pilici

August 26, 2012 at 03:14
Hello Lucas,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Scott

August 26, 2012 at 01:46

Thanks a million Stelian for the clear and easy instructions. Worked like a charm!
Lucas

August 25, 2012 at 21:26

Hi
I followed the steps and everything seemed to go fine up to installing HitmanPro. I wasn’t able to launch do to the virus stopping me. And every time I tried Force Breach I got blue screen. So I tried launch HitmanPro in Safe Mode which seemed to work, it scanned and removed a couple of files. But after when I reboot in Normal Mode I still have the virus, Live Security Premium.
Any ideas?
Many thanks
/Lucas
Stelian Pilici

August 25, 2012 at 17:40
Hello Elicia,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 25, 2012 at 17:38
Hello Greg,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 25, 2012 at 17:35
As I’ve suspected…You are the victim of an ransomware attack… DO NOT SEND ANY MONEY.

Next,can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 25, 2012 at 17:33

Chris, you need to type this command … do not copy/paste the command…
jack

August 25, 2012 at 16:32

thank you. YOU ARE A LEGEND. MUACKSSSS!
chris

August 25, 2012 at 15:47

Hi, when I type in the command:-
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
ll that happens is I get the sc usage instructions appear in the terminal. – ie Description, Usage, Options etc I am copying and pasting it from the webpage so I should have the syntax correct…. any ideas???
Lana

August 25, 2012 at 13:50

There is also that ransome wordpad mesage..go here..pay $500 so it does seem to be a ransom attack as well. I log into windows but can not access any of my files.
brich

August 25, 2012 at 13:48

worked perfectly for me!
Lana

August 25, 2012 at 13:40

Currently, all is running well with the system and internet but I am unable to open any of my files. I have many pictures in Kodak Share and thankfully not to many personal files in word etc. Nothing I would cry over losing. I need to restore the files somehow. They have been encrypted?
Andy F

August 25, 2012 at 12:40

Superb. Fixed my daughter’s laptop and she will be hugely relieved.

Many thanks

Andy
Greg Jackson

August 25, 2012 at 10:43

Hey
I followed all directions, but I still have the virus, the pop-ups with 30+ infections. This is after Malwarebytes and Hitman Pro. Under uninstall programs, the little shield icon is no longer there, but I still get the pop-ups and I can see half of my apps shutdown before I can click and run them. Any help would be great!
Elicia

August 25, 2012 at 06:24

I am so bummed. I have an older computer. It is running Windows XP. It is a Latitude D610, and now matter what I tried, I cannot get the Wireless network working in Safemode. I live where we only have wireless network, no land-line network.

I downloaded Malwarebytes via a friends computer and we put it on a thumb drive. I installed it (from Safemode) on my infected PC, but because I cannot connect to the network with this computer, I cannot get the maleware updates.

I ran a full scan twice with the Malewarebytes I downloaded from your link above. It found two infected files, which I removed. However as soon as I powered up the PC in still had the virus. I am really bummed.

I was running AVG on my laptop, with the latest virus definition files, but it still got infected. I am at my wits end. I sure hope you can help.

Thanks,

Elicia
Stelian Pilici

August 25, 2012 at 03:41

Hello,
Can you please follow this steps:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 25, 2012 at 03:34

It looks like your are also the victim of a ransomware attack….What’s the current status of your computer, can you login into WIndows? Can you view and open your files?
Stelian Pilici

August 25, 2012 at 03:33

Hello,
I need you open Malwarebytes Anti-Malware and go to the More Tools tab,click on Run Tool and then browse to c:\windows\F896D02690164122B9BD957FF092FFE9.TMP.
Stelian Pilici

August 25, 2012 at 03:24

Can you please follow this steps:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Rocky

August 24, 2012 at 19:49

You may have very well just saved my computer!! I was worn’t worried until the Malwarebytes didn’t get rid of it but that second scan by that last system REALLY did the trick!!!

I can’t thank you enough sir!!
Regards, Rocky Chael
Eddie

August 24, 2012 at 15:28

Brilliant. The clearest instructions I’ve seen. Thanks very much.
Chafic Katergi

August 24, 2012 at 15:16

Hello,
I did everything, and I was able to remove the virus, but now everytime i start my pc i get the mesg:
Application failed to intialize: 0x800106ba. A problem caused this program’s service to stop. to start the service, restart your computer or search help and support for how to start a service mannually.
I got the msg from Windows Defender (which is acting razy and not letting do anything).
Also my PC is kind of slow right now.. PLEASE HELP!
Clinton

August 24, 2012 at 05:08

Hello Stelian,

Thank you so much, You are a legend.

Cheers Clinton
Stuart

August 23, 2012 at 22:05

Sir you are a legend its as dead as a doornail i can’t thankyou enough thank you thank you thank you :)
Kris

August 23, 2012 at 21:41

I really appreciate this online guide. I am not tech-savvy at all and your tutorial was EXTREMELY helpful. The step-by-step guide showed me exactly what I needed to do. You are…AWESOME!
Lana

August 23, 2012 at 20:14

I followed all your steps but still get a “congratualtions your sytem will be locked message” It appears on a notepad entiled “How to decrpyt files” I can not access my files. all the scans say their are no threats. ideas?
Chafic Katergi

August 23, 2012 at 17:17

All is good! THX!
ben lockwood

August 23, 2012 at 16:54

Hi, i followed everything and it seems to be gone…. can you please check my combofix log to confirm? Thanks in advance!
Stelian Pilici

August 23, 2012 at 12:35
Hello Stuart,
You can accept that notification and ignore the warning…
Alternatively you can follow this guide:
STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.

STEP 4: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
Stuart

August 23, 2012 at 07:25

Hi Stelian it looks like you have helped alot of people with this problem, im hoping you can now help me. I have done everything upto the RKILL install, Problem being the laptop will not download the file, it downloads approx 1.3mb out of 1.5mb before it is stoped by internet explorer-securty warning it says the file has been blocked because it does not have a valid digital signature that verifies its publisher, I have also tryed the other link you posted but all the other named versions show the same problem on my laptop, is there anyway i can turn this off so i can complete the download Kind regards Stuart
James

August 22, 2012 at 22:44

Hi Stelian,
Did as you suggested – thanks for your help. ComboFix ran immediately after clicking on the top link, scanned and eventually turned the computer off. Everything else found the odd bug. I reinstalled MSE before hand and afterwards but cannot subsequently update it, nor can I access Microsoft downloads, run their Fixit programme or turn on the firewall.
Here are the logs –
RogueKiller V7.6.6 [08/10/2012] by Tigzy

Many thanks for your help,
J
margarita

August 22, 2012 at 20:03

Thank you so much!!!!!!!!!!!!! Everything was easy to follow and the virus is completely gone!!
Rishabh Rastogi

August 22, 2012 at 13:40

Hi Stelian & Des,

I was facing the same problem and tried many techniques and tools to get my windows security centre up and running. I reckon restoring it to a previous restore point is the best option as of now. I tried it after going through the above steps and now the system is once again running smoothly.

Cheers!!
amitabh agarwal

August 22, 2012 at 08:20

Thanks a lot, your trick really work you saved my computer.
Stelian Pilici

August 21, 2012 at 18:25
Hello James,
I think we’ll need to uninstall and the re-install back MSE.
Next can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
James

August 21, 2012 at 09:26

Hello Stelian,
Thanks for all of your advice. Have followed it through and have got rid of Live Security Platinum I think but now have similar issues as above – the Security Centre will not open, MSE will not update ( since I have reisntalled it) nor will Windows update either. Tried Mr Fixit on Microsoft website, but that will not load up. Have tried the cmd also but not certain I did it right – it came up stratight away with administrator. Any further hints please? Sorry to be a pain!
J
des

August 20, 2012 at 20:24

Sorry forgot to mention id tried that before but have tried it again and computer still the same : ( im sure you have another trick up your sleeve though cheers Des.
Stelian Pilici

August 20, 2012 at 17:11

Hello Des,
Can you please follow this steps:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.
Waiting for your reply to tell me if your machine is ok….
Des

August 20, 2012 at 14:39

Hi Stelian my laptop was infected with live security platinum ive followed steps to remove it which work a treat thank you! i then notice on your threads that someone was having trouble with windows update /firewall/defender not working or responding and checked my machine which i found was the same so i followed all the steps rogue killer/kaspersky/esnet/windows repair all in one but its still the same running fine but no firewall etc ive got avast av and hitman pro running am i still at risk and can we fix it any ideas ? cheers Des
Stelian Pilici

August 20, 2012 at 03:39
Hello YianisG,
Those shortcuts are just leftover files which you can delete…… Right click on them and select ;Delete;
Next,lets make sure your computer is really clean :
STEP 1: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Scan button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Stay safe!
Paul

August 19, 2012 at 21:33

Tried it. Worked like a charm!

Thanks a lot man! You save me a lot of stress and money for making this guide! Much appreciated.
Jassz

August 19, 2012 at 09:33

Thanks a lot bro!!! You saved my brand new laptop!!! Incredible work by you…I was almost about to fall for it as I had very important work from job to be done. Many thanks! Cheers!
Christina

August 19, 2012 at 07:33

Omg thank you so much for having this online I was do worried I wouldn’t be able to fix my laptop
YianisG

August 18, 2012 at 19:58

Hello and thanks for the killer guide. all works great, only problem is I can still see Live Security Platinum on my desktop (shortcut) and on my wndows start up list….is this normal?
Stelian Pilici

August 18, 2012 at 18:12

The quickest way to fix this,would be just to re-install Microsoft Security Essentials…
However I do recommend that you uninstall this product and go instead with Avast Antivirus 7 Free as it’s a much better choice…
Stay safe!
Tim

August 18, 2012 at 17:39

Thank you for your help! Everything seems to be working fine except updating spyware definitions on MSE. (error code 0x80240022) This could be due to the fact that I replaced one of the registry files with wscsvc.zip and cant remember what the original file was called. Also dont have a backup. Is there a way to get a list of registry files. I might recognize it if I see it. I looked but couldnt find one
Mark

August 18, 2012 at 17:11

Worked like a charm. Thank you sir.
Spidey

August 17, 2012 at 19:18

The “Activate Free License” option is there for me as of today
Andy

August 17, 2012 at 15:40

Thanks very much for taking the time out to put together this page. Still wishing I could get my hands on these bast*rds!!!
Thanks again
mumdamnkids

August 17, 2012 at 00:27

ooohhh… i just used the registration key, i was starting at step 1…. that worked, thanks for the forum :) one clean laptop
Stelian Pilici

August 16, 2012 at 20:39
Hello mumdamnkids,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
mumdamnkids

August 16, 2012 at 20:37

I can’t connect to the internet on the PC that has live security platinum, the virus has blocked the wifi from connecting (in normal mode) and in safe mode with networking the dell wifi is not recocnised. I tried to save the downloads to usb and run them but with no success. It finds the viruses, which I delete, then the program reinstalls/starts up when I start in normal mode.
Stelian Pilici

August 16, 2012 at 18:10
Hello Marian,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 16, 2012 at 18:07
Helllo Gillian,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 16, 2012 at 18:01
Hello Suze,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utiliti
Stelian Pilici

August 16, 2012 at 18:00
Hello Tim,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
STEP 3: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utiliti
Tim

August 16, 2012 at 17:45

Went through all the steps and seemed to work. Thank You.
I have one problem though, I can’t access my security center.
MSE is working and says that my computer is protected and everything is up to date but why cant I access security center to turn on firewall.
Any suggestions?
Suze

August 16, 2012 at 13:00

Hi I left a post yesterday but it seems to have disappeared! Since getting rid of the virus my laptop doesn’t seem to want to work! When I connect to the Internet it goes really slow and eventually crashes or freezes. Please help
James

August 16, 2012 at 12:46

Thanks! Your tutorial really helped :)
Rosie

August 16, 2012 at 12:30

Stelian you’re a life-saver, thanks man!! Worked perfectly, saved me at least £50 and your instructions were brilliantly easy to follow (as opposed to other techy forums/posts which are clearly written for other computer geniuses, not mere mortal every day users like me). I definitely owe you a pint :-)
Stelian Pilici

August 16, 2012 at 09:12

Hello amar,
Logs look good, can you please run a scan with Malwarebytes and HitmanPro.
How is your computer running now?
Warren

August 16, 2012 at 00:36

Fantastic!!! Great advise, if you follow the instructions you’l get the result you wanted. Really easy to follow and clear and simple instructions! Highly recommended. Many thanks. Warren 15/08/2012 Stockport UK.
Nick

August 15, 2012 at 22:22

Thank you so much for the help. Was very close to putting in the factory reset discs!
amar

August 15, 2012 at 18:50

ComboFix 12-08-14.05 – Amar 15/08/2012 2:49:18.1.2 – x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3070.2252 [GMT -7:00]
Running from: C:\Users\Amar\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
Tom White

August 15, 2012 at 13:45

Thanks a lot, your registryfix.reg did the trick allowing me to run system restore.
amar

August 15, 2012 at 09:25

I can’t get past step 4 with Rkill or the renamed Rkill. Computer says its going to restart, Rkill’s black screen shows no problem found, same a the .txt report. Then computer restarts. So clearly something is wrong. HELP PLEASE. 2 hours and I can’t get past this part
sleepy_chicken

August 15, 2012 at 08:50

Hi,

I got hit with this yesterday and your simple guidance worked brilliantly! One small point, HitmanPro seems to have lost the Activate Free License option…not your problem I know. Fortunately, all nasties were removed and HitmanPro found no additionals.
Gillian

August 15, 2012 at 02:41

Hi

I encounter a problem when running RKill As it’s running I get a pop up window which says “Windows has encountered a critical problem and will restart automatically in one minute Please save your work now” I have tried all the alternate links but my computer restarts everytime at this point How can I stop this so I can proceed to the next step? Many thanks in advance!
Marian

August 15, 2012 at 00:01

Hey Thank a mill for the link! Just wondring if I’ve already used HItman pro Trial in the past, what can I do as the final step instead of hitmanpro??
Stelian Pilici

August 14, 2012 at 14:56
Hello Brian,
Can you please run a scan with Combofix and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Laura

August 13, 2012 at 14:33

Thankyou so so so much you helped me save my computer and a lot of money !
Brian

August 13, 2012 at 13:47

Can help as after running Step 3 Registry Fix my computer shutdown. And restarts automatically, how can I stop this happening so I can solve the problem
Stelian Pilici

August 13, 2012 at 04:32
Hello Hayley,
Did you run the registryfix.reg file??
Can you please run a scan with Combofix and ESET online scanner and post the logs here :

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Stelian Pilici

August 13, 2012 at 04:30
Hello Ali,
Can you please run a scan with the following tools and then copy/paste the logs in your reply.
STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Ali

August 12, 2012 at 22:38

Hi, the original steps appeared to work and remove the program fine. However I then tried to download McAfee protection and the download didnt work – going to their FAQ’s it suggested:

“If you see the “Page cannot be displayed” message or blank page after you press the Download button in your account, your computer might be infected with one of the new malicious viruses that prevent installations and updates. Before you consider optional fee-based virus removal service, please try to open the following Web links:

http://www.symantec.com/norton/index.jsp
http://us.mcafee.com/

If you are not able to view the McAfee or Symantec sites OR you see pop-ups with the names similar to Personal Antivirus, Antivirus 360, AntiSpyware 2009, Alpha Antivirus, Green Antivirus, Internet Security 2010 stating that your computer is infected, the issue is almost certainly caused by the previously mentioned virus and even the installation disk (CD) will not help.
In order to load anti-virus software, people with infected computers must first remove the virus that prevents the installation and updates.”

I can’t view either the McAfee or Symantec websites (computer in Normal mode) which suggests there is still a part of the program on my laptop – any suggestions?

Many thanks in advanced!
timothy

August 12, 2012 at 19:36

Hi, I would just like to say thanks. This site is a lifesaver. I got the virus on a work computer. I had to run the scans a few times before the virus was removed. May God bless, you have prevented many heart attacks with this service. Please keep it up.
Hayley

August 12, 2012 at 14:16

Hi,

I have tried to download hitman pro, however it doesn’t seem to let me install it. I have the option of ‘open with’ a list of programmes but it won’t let me open it with anything. Please can you help?
PB

August 12, 2012 at 11:24

Thanks so much!
ian yeti

August 11, 2012 at 16:00

thanks a lot for your help, fix worked great!
ange

August 11, 2012 at 11:53

Bless you x 2903840392 million – had a melt down thinking the computer was unsaveable, and then I found your blog. I have been using computers for almost 20 years and have never had a virus – it was so good to know there was info to fix it. I encountered a few troubles along the way (RKill kept rebooting, couldn’t open Hitman in force breach mode) but you always had another way to get around things. Am now installing anti-virus software based on your reccommendation and fingers crossed this doesn’t happen again for another 20 years! Thanks so much for a FREE and EASY way to save a computer.
Stelian Pilici

August 11, 2012 at 08:57
Hello Alex,
Please perform the following steps:
Step 1: Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  [b]RogueKiller Download Link[/b] (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
The report has been created on the desktop.In your next reply please post:

[b]All RKreport.txt [/b] text files located on your desktop.

2.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
1. Save it to your desktop.
2. Double click the setup file to run it.
3. Follow the onscreen prompts until it is installed
4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
  - System Memory
  - Hidden startup objects
  - Disk boot sectors
  - Local Disk (C:)
  - Also any other drives (Removable that you may have)
5. Then click on Actions on the left hand side
6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
7. Click on Automatic Scan
8. Now click the Start Scanning button, to run the scan
9. After the scan is complete, click the reports button (‘Paper icon’, next to the ‘cog’ icon) on the right hand side
10. Click Detected threats on the left
11. Now click the Save button, and save it as kaslog.txt to your Desktop
12. Please copy and paste the contents of kaslog.txt in your next reply.
3.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Now, let try to repair your computer:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.

Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
1. Click Unselect All
2. Put a checkmark in the following items:
  - Repair Hosts File
  - Remove Temp Files
  - Repair Windows Firewall
  - Remove Policies Set By Infections
  - Set Window Services To Default Startup
  Note: Leave everything else unchecked
3. Put a checkmark in Restart System When Finished
4. Now click the Start button (bottom right)
Stelian Pilici

August 11, 2012 at 08:51
Hello Billy,
Can you please perform the following steps:
STEP 1: Run a scan with ESET Online Scanner
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push List of found threats
9. Push Export to Text file and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.Note – when ESET doesn’t find any threats, no report will be created.
10. Push the back button.
11. Push Finish
STEP 2: Reset Internet Explorer to default settings
1. Open Internet Explorer ‘Internet Options
  For Internet Explorer 9 : Click on the gear icon at the top (far right) and click again on Internet Options
2. Now in the Internet Options dialog box, click on the Advanced tab, click Reset
3. In the Reset Internet Explorer settings section. Click Reset again in the information dialog box.
4. When Internet Explorer finishes resetting, click Close in the confirmation dialogue box and then click OK.
5. Close and open Internet Explorer again.
Waiting for your reply to tell me how everything is working…
Stelian Pilici

August 11, 2012 at 08:41

Hello Jeny,
It’s good to see that you’ve manage to get rid of this virus.Now,as far as your real time protection goes,I advise to uninstall McAfee because this product it’s not the smartest choice you can make.Below you can find some quick suggestions on what products you can use:
Free – Avast Antivirus 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012,Avast Internet Security 7,G-DATA Internet Security 2012 or ESET Smart Security 5.
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layered security config: http://malwaretips.com/Forum-Security-Configuration-Wizard

Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
Michael Francis Manuel

August 11, 2012 at 05:14

Your guldens — really superb. I have removed it successfully. Thanks a lot.
Jenny

August 11, 2012 at 00:46

Having just got my laptop back from being cleaned of the Ukash virus I was horrified that this one suddenly popped up and envisaged another £50 and another week in computer hospital !! However, thank you so much for these very clear instructions that even I (age 68 !) found easy to follow and once again I have a clean laptop.
One question though, on both occasions my full, licensed McAfee security appears to have become disabled, in fact today it was actually running a scan when this nasty bug popped up. Is this a problem with McAfee ? Perhaps I should change my security or does this happen with all security systems?
Once again – thank you so much.
Stelian Pilici

August 10, 2012 at 21:44
Hello,
Can you please follow the below steps:
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me how everything is running!
Good luck…
JEPiper

August 10, 2012 at 16:19

When I try to download malwarebytes, I download a php file not an exe file. I can then only open the file in a wordpad. I have tried downloading Mal several time to no avail. What next?
JEP
Veronika

August 10, 2012 at 02:54

At first i thought there was too many steps but when i followed ur instructions step by step its not difficult at all! Thaaaankkkk yooouuu veryyyyy muccchhhh!!!
BillyBob

August 9, 2012 at 19:31

Hi Stelian,
I’ve followed your instructions to remove Live Security Platinum, but now I have a new issue. Internet explorer no longer saves my browsing history, and every time I start my computer, Windows Explorer crashes and I have to close and restart Windows Explorer before I can do anything. Have you any advice?
Alex

August 9, 2012 at 14:29

Hi, I safely got rid of the virus, so thanks! However, had a problem with windows defender and security settings being turned off. Also my windows update fails. I tried combo fix and got this log.

ComboFix 12-08-08.03 – Alex 09/08/2012 14:54:56.1.4 – x64
Microsoft® Windows Vista™ Ultimate 6.0.6001.3.1252.44.1033.18.4094.2644 [GMT 1:00]
Running from: c:\users\Alex\Downloads\Combo-Fix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex\Documents\~WRL2783.tmp
Any help would be much appreciated.

Alex
Simon

August 9, 2012 at 10:53

Many thanks for these instructions, worked a charm and laptop is now free of this virus. A little surprised that malwarebytes (and McAfee) did not cover the files discovered by Hitman but the combination worked. Appreciate the simple, clear instructions here.
Darkbyte

August 9, 2012 at 10:23

Hi, I found these instructions a breeze with your help I got rid of this nasty thing with the tools you have described. I was really shocked when I got hit with this virus as it knocked my anti-virus protection off in front of my eyes which I was shocked and then when it flashed those bogus screens it had the cheek to switch it back on. I soon as I saw all that I pulled the plug, and got to work with your instructions.

I just want to say Thanks, and thank you again and again.

DB
gengreen

August 9, 2012 at 07:13

Absolutely fantastic. Thank you for saving my computer. Very easy to follow instructions that actually worked. Bloody marvelous. :)
Peejay

August 9, 2012 at 06:33

I’d like to thank you for such precise and seemingly accurate instructions

My computer appeared completely taken over by the virus but now seems to be working great, virus free

A serious virus but a fantastic solution…thank you for putting yourself out there and helping to fix my pc
soheil

August 8, 2012 at 18:40

AWESOME COMMENT AWESOME COMMENT AWESOME COMMENT
Thank you so much .im not pro in pc but all your instructions worked perfectly and easy.
thank you
Snappahead

August 8, 2012 at 11:00

Thanks heaps … used your guide to fix up my parents computer and it worked a treat.
Stelian Pilici

August 8, 2012 at 03:54

Please follow the guide above…… :)
David

August 8, 2012 at 01:46

That did not work for me.
Stelian Pilici

August 7, 2012 at 19:04

AWESOME COMMENT!Thank you!
I hope you’ll have a beautiful life!Stay safe!:D
John

August 7, 2012 at 19:01

Just finished using your instructions to rid my grandson’s laptop of this pest. Even an old Luddite like me found it easy and my grandson now thinks that I am ‘cool’. I believe that is almost a compliment! I am most grateful to you for your help Stelian.
Jodi

August 7, 2012 at 13:36

Thank you so much Stelian! All your instructions worked perfectly and were very easy to follow. I appreciate all the money you saved me from having to take my laptop into the shop. Thanks a million.
Yannick

August 7, 2012 at 12:30

This site is the one that fixed it for me, thx a lot.
I tried 5 others without succes, this is a complete one that
really gets rid of the f%ing Live Platinum…
Props to the creator!!!
sajaad

August 7, 2012 at 03:17

You are a life saver. Thank you so much. If I were living anywhere close to you I would have depended on you for all my computer needs, and you would have had a lifetime customer.
Liam

August 7, 2012 at 02:22

Just used this guide to remove the virus from my Dad’s PC. Worked great thankyou!
Alison

August 6, 2012 at 14:40

Hi
Can’t thank you enough – just when I’m on a deadline I pick up this damn malware. Your method worked a charm although oddly RKill found nothing – m-ban caught it and killed it dead.
christine

August 6, 2012 at 12:46

Many thanks for your help ! Worked perfectly thanks to very clear instructions ! Please note that I had no access to free trial for HitMan Pro, only commercial versions. Thanks again.
Manoj Perera

August 6, 2012 at 01:06

Hi Friend,

Live Security Platinum removal can be done in one easy step. Just in the windows run type regedit

When windows registry opens in the file find menu search for registry of Live Security Platinum registry location for “6F63A58B2B17D979CE3E2E66E56C3425” then right click on this file and click option “delete” and make sure that you are restarting the PC after this.

Thats all and also remember to delete the shortcut icon for Live Security Platinum in desktop.

Good Luck !

Regards,

Manoj Perera
Bcs Hons
Karen

August 5, 2012 at 22:33

Stelian – you saved my computer and made me feel competent!
You’ve restored my faith in humanity – funny how something nice can come from something crappy…
I’m off to check out your security configuration wizard now.
Thank you!!
Stelian Pilici

August 5, 2012 at 21:15
Hello sean,
Lets try another way around this :
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.

STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.

STEP 3. Run a scan with ESET Online Scanner
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push List of found threats
9. Push Export to Text file and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.Note – when ESET doesn’t find any threats, no report will be created.
10. Push the back button.
11. Push Finish
Waiting for your reply to tell me how everything is working.. :) Good luck!
sean

August 5, 2012 at 19:32

when i run malware bytes anti malware it completes the scan and then when i click to remove the infected files an error message comes up saying overflow.
whats wrong?
Ressam

August 5, 2012 at 17:57

I just read your article and followed your instructions. My Sony Vaio is free of stupid Live Security Platinum now.
You rock!
Thanks a million. :)
Stelian Pilici

August 5, 2012 at 16:30
Hello Peter,
Lets try to see if we can fix this :
Get a USB stick and copy on it Combofix, then transfer it to the infected computer and perform the following steps:
Please read and follow all the steps very carefully.

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2 : Download and run the Complete Internet Repair utility.
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
- Reset Interent Protocol (TCP/IP)
- Repair Winsock (Reset Catalog)
- Renew Internet Connection
- Flush DNS Resolver Cache
- Reset Windows Firewall Configuration
- Reset the default hosts fie
Let me know if this fixed the problem…
Stelian Pilici

August 5, 2012 at 16:27
Hello,
Lets try another way around this
While in Normal Mode,please try to download and run Malwarebytes Chameleon:
1. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
2. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
3. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
4. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
5. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
6. Upon completion of the scan, if anything has been detected, click on Show Result
7. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
8. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
If it still doesn’t want to work, please try the above steps while in Safe Mode with Networking.
Waiting for your reply to see how everything is running…. Good luck!
Stelian Pilici

August 5, 2012 at 16:22
Hello Ti,,
Lets see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Stelian Pilici

August 5, 2012 at 16:20

Hello,
Yes you can remove all the tools that we used if you want!:)
John R

August 5, 2012 at 13:49

Your solution to getting rid of the Live Platinum Virus worked very nicely and was easy to implement! Thank you very much. I had expected to have lost my computer for good. In addition, the computer’s performance improved a lot.

Quick follow-up question… Should I remove RKill and Malware by Anti Malware once the virus has been removed? If so, how do I do this?

Thank you.
a

August 5, 2012 at 10:02

Awesome! Totally worked just as described. Thank you
Peter

August 5, 2012 at 00:19

Stelian,

My girlfriend caught this virus (ironically when researching cat viruses!) and I used your site to clean it. I had the 1 minute countdown too, so had to use normal mode. I never lost internet when the virus was on, and the proxy box wasn’t ticked. I cleaned everything, took a while but got there. Thanks.

I then noticed that the firewall (McAfee) was off. When I tried to fix that, the internet went down. I decided to start right back at the beginning but again, the proxy box isn’t fixed. As mbam looks for updates and hitman needs an internet connection I’m now a little stuck. Without updates, mbam finds nothing, nor does rkill. I would assume I have enabled some sort of firewall but neither McAfee nor Windows think it’s running. I know the computer is registered with the router as I can log on and see it from a different computer.

If I have to I’ll reinstall windows but I need to back up some files first – where does this virus lurk? i.e. will I inadvertently transfer it by backing up to a memory stick?

Yours hopefully…

p.s. like the “Norman” mode you refer to above – does that make “Anglo-Saxon” safe mode?!
Tim

August 4, 2012 at 21:44

I am able to install all programs, but when I am in the middle of my scan, my computer shuts down every time. Same thing also happens when I try and use pc tools product.
Sandra Humphrey

August 4, 2012 at 20:14

I’M SO UPSET, I HAVE JUST PAID £60 TO HAVE WINDOWS REINSTALLED AND TO PUT A ANTIVIRUS SOFTWARE ON IT. I DID NOT KNOW THAT I COULD HAVE REMOVED IT. I THOUGHT MY COMPUTER WAS OVER IT WOULD NOT ALLOW ME ACCESS TO MY FILES AND IT WOULD NOT LET ME GO ON THE INTERNET. THERE WAS SO MUCH TROJAN ON MY LAPTOP. I WISH I HAD SEEN THIS FIRST.
rahmat putra

August 4, 2012 at 17:23

thanks a lot…its work…
KCinCRISIS

August 4, 2012 at 11:17

Hi Stelian,

I am having the same issues as jonny. I attempted your ‘normal mode’ version but cannot get passed the first hurdle.

As soon as I open IE I get
WARNING! THe site you are trying to visit may harm your computer etc.

I do get an option to ignore it and continue regardless but would like your reassurance that that is what I should do??……

Regards
KCinCRISIS
Stelian Pilici

August 4, 2012 at 05:32
Hello Johny,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Jonny

August 3, 2012 at 23:58

Hey Stelian. i was following your guide and its well explained but my problem is when i get to step 4. 3. starting Rkill. when i start Rkill i get a message saying that windows has encountered a critical error and will restart in one minute. then Rkill finishes its scan and i get the Rkill log and then the laptop unintentionally shuts down and i cant get past the problem. its happened a couple of times now 2 in safe mode with networking and once in normal mode.
StripedCat

August 3, 2012 at 19:32

I ran through the steps as listed above. I noticed that initially the malware was listed as a recently installed program under ‘All Programs’. However, when I started running the Malwarebytes software, it disappeared.
After running the Malwarebytes program, deleting the bad files and rebooting the computer, the malware had still not been removed. Instead, it would not let me open any of my browsers or other apps, or even run Malwarebytes or Rkill in normal mode, indicating that they were all infected. I went back into safe mode and ran Hitman, which seemed to work.
I noticed that a lot of forums listed questions within the past week or so, indicating that it is a recent malware. Perhaps they are getting smart as well and countering the detection and removal softwares.
Great link! Thanks for your help!
Stelian Pilici

August 3, 2012 at 16:24

Hello,
It’s good to see that you’ve manage to get rid of this virus. :)
As far as your real time protection goes,I advise to install a security product to protect your computer.Below you can find some quick suggestions:
Free – Avast 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012,Avast Internet Security 7,G-DATA Internet Security 2012 or ESET Smart Security 5.
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layered security config: http://malwaretips.com/Forum-Security-Configuration-Wizard

Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
Trapper18

August 3, 2012 at 16:21

Hey man, after I ran hitman pro on normal mode while holding down left ctrl, the virus was gone. All programs worked after that! Thanks man!
espanyol

August 3, 2012 at 14:31

tenx a lot! your a genius!
Guy

August 3, 2012 at 14:19

Looks like the your first 6 steps did the trick. I’m very grateful for your solution – many thanks
(My Anti-virus had just expired when I got the infection ! )
Now I’m off to renew my protection
Deepthi

August 3, 2012 at 11:39

Million Thanks, you made me got rid of this virus.

Thanks a lot
Stelian Pilici

August 3, 2012 at 11:32
Hello espanyol,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
espanyol

August 3, 2012 at 05:31

when i run the malwarebytes ( anti malware ) scanning didnot complete. Windows error appear ( encountered problem……… ). what will i do…i am not using home pc…iam at business.. hope to reply. thanks
Stelian Pilici

August 3, 2012 at 03:28
Hello Melissa,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
1. Download Malwarebytes Chameleon from here and extract it to a folder in a convenient location
2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
7. Upon completion of the scan, if anything has been detected, click on Show Result
8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats
2.Please perform a scan with HitmanPro as seen on the guide.

3.Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Jessi

August 3, 2012 at 03:03

Thank You so much for explaining step by step how to get rid of this virus. I thought my computer was done for. Again, thank you very much for the help and have a nice day. ^_^

Thursday, August 02, 2012
Melissa

August 3, 2012 at 00:51

After/during the time that I ran RKill, my computer popped up with a message the windows needed to shut down immediately, then it logged me off and restarted. Any suggestions?
Stelian Pilici

August 2, 2012 at 20:40
Hello TJ,
Please run this two scans to remove the ZeroAccess rootkit:

STEP 1 : Run a scan with Combofix

Download ComboFix from one of the following locations:

COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)

VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  ———————————————————–
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
    ———————————————————–
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  ———————————————————–
1. Double click on ComboFix.exe & follow the prompts.
2. Accept the disclaimer and allow to update if it asks
3. When finished, it shall produce a log for you.
Notes:
1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.
STEP 2: Run a scan with ESET Online Scanner:
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
Waiting for your reply to tell me if your machine is ok ..
TJ

August 2, 2012 at 20:21

I followed you instruction and the live was still there. I tried the rogue killer since this is corporate computer still and got message in French that root kit zero access needed to be removed. I do not understand
Stelian Pilici

August 2, 2012 at 17:11
Hello Lexi,
You most likely have other infections besides this rogue,lets try another way around this :
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.

STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.

STEP 3. Run a scan with ESET Online Scanner
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push List of found threats
9. Push Export to Text file and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.Note – when ESET doesn’t find any threats, no report will be created.
10. Push the back button.
11. Push Finish
Waiting for your reply to tell me how everything is working.. :) Good luck!
Trapper18

August 2, 2012 at 15:14

Hey mate, when I ran the MalWare scan my computer shut down halfway through? What’s wrong?

Cheers
MiniMe

August 2, 2012 at 07:29

Worked Wonderully! First I was skeptical about the authenticity of this article, but it saved my computer! Thankyou very very much. Now, can u please suggest me how to keep my computer save and please post the download link for avast 7? :)
Stelian Pilici

August 1, 2012 at 17:53
Hello,
Is this your personal computer or from work?It’s important to know that only home users can use this product when it comes to malware removal however for corporate/business computer the malware removal isn’t free.
You can perform a scan with the following utilities:

1.Run a scan with RogueKiller
1. Please download the latest official version of RogueKiller.
  ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
3. After the scan has completed, press the Delete button to remove any malicious registry keys.
4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
2.Run a scan with Eset Online Scanner.
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push Finish
JET

August 1, 2012 at 17:11

I used Hitman Pro for the scan but when I continue there is no option to use a trial, only register.
Stelian Pilici

August 1, 2012 at 12:03
Hello Erik,
Lets try another way around this :
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.

STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes and then do a RogueKiller and Unhide.exe scan as seen on the guide

STEP 3. Run a scan with ESET Online Scanner
1. Download ESET Online Scanner utility.
  ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Check Scan archives
6. Push the Start button.
7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
8. When the scan completes, push List of found threats
9. Push Export to Text file and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.Note – when ESET doesn’t find any threats, no report will be created.
10. Push the back button.
11. Push Finish
Waiting for your reply to tell me how everything is working.. :) Good luck!
Erik

August 1, 2012 at 06:19

After running RKILL, I get a message saying that the computer will reboot in 1 minute, cannot stop it from doing this. Keeps me from going to the next step.
Stelian Pilici

August 1, 2012 at 03:19

Hello Jeff and thank you!
Jeff Everett

August 1, 2012 at 00:33

I’m a MS certified tech, used this guide to remove Live Security Plantinum in 3 systems in the last 7 days. Great article and thanks a million!
Patti B`

July 31, 2012 at 21:56

Thank you sooo much. My daughter’s new laptop was infected with this virus and she was heartbroken ~ you made it so easy to fix with your great instructions. For every mean person putting these virus and worms out there – I hope there is a kind soul like you out there to give us all hope for our computers and our collective goodness!
Watchc

July 31, 2012 at 04:49

Really appreciate your time for posting detailed screen info. It worked like gem and I used this process to clean my two pc’s.

Tahnks a lot again for the instructions.
Star

July 31, 2012 at 03:50

Hi Stelian,

Thank you SOOO SOOOOO much for this information, i don’thave enough words to thank you. i’m not a computer genius and usually i ask mybrother or someone in a case likethis but today i had no help and spent nearly 2hours on the net trin to find a way when i found your article. after reading it and the comments i built trust and followed the guide. it was fantastic. thank you soooooooo much. thanks to you now i can go ahead with my applications for jobs and other work. really appreciate your kindness and generous offer of your time and advice. helped me soooo much :):)
James

July 30, 2012 at 17:51

The instructions were quite helpful, thank you. I do have one question though… Based on the dates and times on the folders, it appears as though this thing ended up on my laptop yesterday. It happened while my wife was on it, and only moments after she powered it up. I’m tryign to backtrack and figure out HOW it got on there in the first place. Any ideas or downloaded items I could look for that would be tell-tale signs of where it came from? Thanks.
Yoyo

July 30, 2012 at 10:17

Thanks – instructions are clear and easy to use and it works!
Krystyna

July 30, 2012 at 04:09

Hello, Thank you for the detailed instructions. I was in tears when I could not stop that thing from operating and saw how sophisticated it is. Luckily I was able to find your site via the phone internet and get my computer back to operation.
Stelian Pilici

July 29, 2012 at 16:03

Lets try this trick:
1.Create and run your registryfix.reg

A.Copy all the text in bold below and paste to Notepad/Text Document

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.exe\shell]

[-HKEY_CLASSES_ROOT\.exe\DefaultIcon]

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”

[HKEY_CLASSES_ROOT\exefile]
“Content Type”=-

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”
“IsolatedCommand”=-

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
“IsolatedCommand”=-

[HKEY_CLASSES_ROOT\.bat]
@=”batfile”

[HKEY_CLASSES_ROOT\batfile\shell\open\command]
@=”\”%1\” %*”

[-HKEY_CURRENT_USER\SOFTWARE\Classes\.exe]

[-HKEY_CURRENT_USER\Software\Classes\exefile]

[-HKEY_CLASSES_ROOT\secfile]

[-HKEY_CURRENT_USER\Software\Classes\secfile]

[-HKEY_CLASSES_ROOT\pezfile]

[-HKEY_CURRENT_USER\Software\Classes\pezfile]

[-HKEY_CLASSES_ROOT\sezfile]

[-HKEY_CURRENT_USER\Software\Classes\sezfile]

[-HKEY_CLASSES_ROOT\ah]

[-HKEY_CURRENT_USER\Software\Classes\ah]

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
@=”firefox.exe”

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command]
@=”firefox.exe”

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@=”iexplore.exe”

B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)

C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.

2.Hold down the WINDOWS key and press the R key,this should brind up the Run box…. In it, please type the below content…

iexplore.exe http://download.bleepingcomputer.com/grinler/WiNlOgOn.exe

Let the program run,until a log its produced (5 – 10 minutes max)

3.Next, hold down the WINDOWS key and press the R key,this should brind up the Run box…. In it, please type the below content…

iexplore.exe http://www.malwarebytes.org/mbam-download-exe.php

Update and Run a full system scan with Malwarebytes as seen on the above guide.
Next,run the other tools (HitmanPro,RogueKiller and Unhide.exe from the guide)

Let me know how everything goes…
wes

July 29, 2012 at 12:21

When I click internet explorer I receive a message that says, “Internet Explorer has stopped working”

Can’t access the internet on my infected computer. What next?
GuaB

July 29, 2012 at 11:45

Perfect!!! … you save my life
Thanks x 1000
The only thing is that I couldn’t find HitmanPro free trial.
Ana da Silva

July 28, 2012 at 22:53

Thank you so much.
Moltas gracies.
Muito Obrigado.
OnyxDusk

July 28, 2012 at 19:08

Brilliant! Easy to follow! Thankyou, thankyou, thankyou! X
Deepak

July 28, 2012 at 10:06

Thanks a lot Stelian,,, You really rock,,,
david

July 28, 2012 at 03:04

thankyou so much
Grinch Mx.

July 27, 2012 at 04:10

Just wanna say thank you,I have looked at a lot of websites and they all offer solutions that don’t work!Your site is great! THANK YOU!
Tranchisan

July 27, 2012 at 03:52

Thank you Stelian!This worked perfectly !! +1 for you!