Live Security Platinum is a malicious program also known as rogue security software, which will display fake security alerts in an attempt to scare you into buying this fake security product.
In addition, Live Security Platinum has also hijacked your PC,blocking your from running files,so now when your trying to open and executable file (file ending with .exe), this program will instead display this fake alerts:
Warning!
Application cannot be executed. The file rdpclip.exe is infected. Please active your antivirus software.
Security Monitor: WARNING!
Attention! System detected a potential hazard (TrojanSPM/LX) on your computer that may infect executable files. Your private information and PC safety is at risk.
To get rid of unwanted spyware and keep your computer safe you need to update your current security software.
Click Yes to download official intrusion detection system (IDS software).
Live Security Platinum Warning Spyware.IEMonster activity detected. This is spyware that attempts to steal passwords from Internet Explorer, Mozilla FireFox, Outlook and other programs. Click here to remove it immediately with Live Security Platinum
Live Security Platinum Firewall Alert Live Security Platinum Firewall has blocked a program from accessing the Internet. Internet Explorer Internet Browser is infected with SVCHOST.Stealth.Key-logger. This worm is trying to send your credit card details using Internet Explorer Internet Browser to connect to remove host
Live Security Platinum will also cause malicious browser redirects and system slowdowns so it needs to be removed from your computer as soon as possible.
This is are a few images of Live Security Platinum:
Registration codes for Live Security Platinum
As an optional step,you can use the following license key to register Live Security Platinum and stop the fake alerts.
AA39754E-715219CE
Please keep in mind that entering the above registration code will NOT remove Live Security Platinum from your computer , instead it will just stop the fake alerts so that you’ll be able to complete our removal guide more easily.
Live Security Platinum Removal Guide
STEP 1 : Start your computer in Safe Mode with Networking
- Remove all floppy disks, CDs, and DVDs from your computer, and then restart your computer.
- Press and hold the F8 key as your computer restarts.Please keep in mind that you need to press the F8 key before the Windows start-up logo appears.
Note: With some computers, if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the “F8 key”, tap the “F8 key” continuously until you get the Advanced Boot Options screen. - On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking , and then press ENTER.
STEP 2: Remove Live Security Platinum malicious proxy server
Live Security Platinum may add a proxy server which prevents the user from accessing the internet,follow the below instructions to remove the proxy.
- Start the Internet Explorer browser and if you are using Internet Explorer 9 ,click on the gear icon (Tools for Internet Explorer 8 users) ,then select Internet Options.
- Go to the tab Connections.At the bottom, click on LAN settings.
- Uncheck the option Use a proxy server for your LAN. This should remove the malicious proxy server and allow you to use the internet again.
If you are a Firefox users, go to Firefox(upper left corner) → Options → Advanced tab → Network → Settings → Select No Proxy
STEP 3: Repair your Windows Registry from Live Security Platinum malicious changes.
Smart Fortress 2012 has changed your Windows registry settings so that when you try to run a executable file (ending with .exe ) , it will instead launch the infection rather than the desired program.
- Download the registryfix.reg file to fix the malicious registry changes from Live Security Platinum.
REGISTRYFIX.REG DOWNLOAD LINK (This link will automatically download the registry fix called registryfix.reg) - Double-click on registryfix.reg file to run it. Click “Yes” for Registry Editor prompt window,then click OK.
STEP 4: Run RKill to terminate known malware processes associated with Live Security Platinum.
RKill is a program that will attempt to terminate all malicious processes associated with Live Security Platinum,so that we will be able to perform the next step without being interrupted by this malicious software.
Because this utility will only stop Live Security Platinum running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again.
- While your computer is in Safe Mode with Networking ,please download the latest official version of RKill.Please note that we will use a renamed version of RKILL so that Live Security Platinum won’t block this utility from running.
RKILL DOWNLOAD LINK (This link will automatically download RKILL renamed as iExplore.exe) - Double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Live Security Platinum.
- RKill will now start working in the background, please be patient while the program looks for various malware programs and tries to terminate them.
IF you are having problems starting or running RKill, you can download any other renamed versions of RKill from here. - When Rkill has completed its task, it will generate a log. You can then proceed with the rest of the guide.
WARNING: Do not reboot your computer after running RKill as the malware process will start again , preventing you from properly performing the next step.
STEP 5: Remove Live Security Platinum malicious files with Malwarebytes Anti-Malware FREE
- Download the latest official version of Malwarebytes Anti-Malware FREE.
MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK (This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free) - Start the Malwarebytes’ Anti-Malware installation process by double clicking on mbam-setup file.
- When the installation begins, keep following the prompts in order to continue with the setup process. Do not make any changes to default settings and when the program has finished installing, make sure you leave both the Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware checked. Then click on the Finish button. If Malwarebytes’ prompts you to reboot, please do not do so.
- Malwarebytes Anti-Malware will now start and you’ll be prompted to start a trial period , please select ‘Decline‘ as we just want to use the on-demand scanner.
- On the Scanner tab,select Perform full scan and then click on the Scanbutton to start scanning your computer.
- Malwarebytes’ Anti-Malware will now start scanning your computer for Live Security Platinum malicious files as shown below.
- When the scan is finished a message box will appear, click OK to continue.
- You will now be presented with a screen showing you the malware infections that Malwarebytes’ Anti-Malware has detected.Please note that the infections found may be different than what is shown in the image.Make sure that everything is Checked (ticked) and click on the Remove Selectedbutton.
- Malwarebytes’ Anti-Malware will now start removing the malicious files.After completing this task it will display a message stating that it needs to reboot,please allow this request and then let your PC boot in Normal mode.
STEP 6: Double check your system for any left over infections with HitmanPro
- This step can be performed in Normal Mode ,so please download the latest official version of HitmanPro.
HITMANPRO DOWNLOAD LINK(This link will open a download page in a new window from where you can download HitmanPro) - Double click on the previously downloaded fileto start the HitmanPro installation.
IF you are experiencing problems while trying to starting HitmanPro, you can use the “Force Breach” mode.To start this program in Force Breach mode, hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including the malware process. (How to start HitmanPro in Force Breach mode – Video) - Click on Next to install HitmanPro on your system.
- The setup screen is displayed, from which you can decide whether you wish to install HitmanPro on your machine or just perform a one-time scan, select a option then click on Next to start a system scan.
- HitmanPro will start scanning your system for malicious files. Depending on the size of your hard drive, and the performance of your computer, this step will take several minutes.
- Once the scan is complete,a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click Next.
- Click Activate free license to start the free 30 days trial and remove the malicious files.
- HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
STEP 7: Remove any left over malicious registry keys and files
Live Security Platinum has sadded some malicious registry keys to your Windows installation , to remove this malicious changes we need to run a scan with RogueKiller
- Please download the latest official version of RogueKiller.
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer) - Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
- After the scan has completed, press the Delete button to remove any malicious registry keys.
- Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.
I often see posts where the issue didn’t work out thru no fault of the person doing the helping on somebody’s PC problem. The person getting the help is totally disrespectful. Being thankful for someone trying to help is expected when they didn’t cause the problem to begin with. They are taking their own time to try and help. It’s totally the fault of the person with the problem. If you would do diligence on the daily maintenance end of your own computer, keep it updated, install the necessary essential security software like spyware, malware, registry cleaner, and keep your device drivers up to date, and keep it backed up daily which only takes a minute or two, you could eliminate the majority of your computer problems. Downloading all the freeware out there to save a buck is just the beginning of your problems.
Hello,
You’ve got a pretty nasty infection on this machine. It’s a ZeroAccess rootkit which has corrupted your Windows Defender settings.
To remove this infection, please follow the instructions from this guide: http://malwaretips.com/blogs/file-contained-a-virus-and-was-deleted-removal/
Stay safe!
Hello aixirt,
You can follow this guide: http://malwaretips.com/blogs/win-7-internet-security-2011-virus/
Stay safe!
i mean threats
Good day Stelian!
I am one of those infected this malware and I followed the above instruction of yours last 5 months ago.
I am now infected with another malware yesterday, the name is “windows xp 2011 unregistered version”.
I would like to know if you have encountered this treats and made a post how to get rid off it.
I searched in the web yet I am not satisfied about their instruction.
Your posts were perfectly clear and easy to follow step by step.
Hope you can help me. Thanks a lot.
Oh thank you great malware remover god. I am naming all my grandchildren after you!!!! Even if they are girls!!!
Thanks a lot!
Thankyou – this blog was great – followed every step and now have my computer back – AWESOME
Thank you SteliaN!
YOU ROCK!You should get a medal!
phenomenal! thanks a lot.
** tnx mate :)
tnx might
You are a great man!Thank you.
Hello Magnus,
The Kaspersky desinfection process is really slow and not well designed…however it works…..Now can you please run a Combofix scan and post the log here so that I can take a look at what’s going on your machine:
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
Notes:
Thanks!
Greetings from Mexico,
Thx a lot for your help !!
You Rock Stelian, See ya !!
Ok. I ran Kaspersky and it was supposed to take about 4 and a half hours, but about 3 hours in, it found a virus, Trojan? that it said it had to deal with immediately. This was a separate pop up window, and the scanner was still scanning in the background. At first I was going to wait till the scanner finished, but it had about another hour and a half to go. So to take care of the pop up window, it said to either ‘disinfect the files’ or some other option which was something like “No, not now…”. Seeing as this looked important, and it said after it fixed the files it would reboot, I didn’t know how the scan would react to this. If it finished before the original scan finished, then it would reboot and my 3+ hours of scanning would be in vain! I wasn’t going to wait around for another hour and a half, so I clicked “Yes, Disinfect my computer…” and it opened another window that started scanning on top of the other scanner. I was prompted to do this partly because I think the new virus (something like “seomncxrv.exe” with a red umbrella logo in ProcessExplorer, and when I googled the exact file name, google came up blank (not a single page)!!! Perhaps I should have got the hint,) was already causing me problems. Anyway, in middle of the second scan, the first scan just stopped, and I had to fool around with the program to find out what it found. It found a bunch of bad files and I clicked “Neutralize them”, and tried to get Kaspersky to fix the problems. It went back to the ‘Disinfect’ scan and I think I closed the other scan in frustration. But I don’t remember exactly what happened next, but basically, I think the virus tried to do something and something happened and the next thing I know windows explorer stopped working so that everything on my desktop disappeared, the taskbar, everything, and the only thing left was the Disinfect Scan. It said it had about 15 minutes left, so I let it run. What else could I do? After it finished, it rebooted the computer. Thank goodness, because I had no access to anything. Once it restarted (everything went back to normal), Kaspersky was deleting some stuff, and then it opened to the regular page, asking me to install the program. At this point I didn’t know what to do, but it looked like it successfully deleted the new virus, Trojan, so I decided to continue with your advice. I closed Kaspersky and downloaded and scanned with ESET scanner, and it found 27 bad files. I think it took care of them. After that I scanned with HitmanPro, and this time it found 13 problematic items. As the removal of these is disabled on my HitmanPro, what should I do now? Do you still want a log of the Tracking Cookies and ZeroAccesses? Or seeing as this whole process didn’t go as planned, perhaps there is another path that I should be taking? Where do we go from here?
Thanks for all your help.
Hello Magnus,
We can manually remove this files however let’s see if we can get rid of some of them using the below software:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
NEXT,please re-run a scan with HitmanPro and post the log or a screenshot here and I’ll give you instructions on how to remove the left over files.
Good luck!
Hey Stellion. I got the Live Security Platinum Virus on my compter again, but this time I was able to follow your guide. I got pretty far in it (and I think Malwarebytes deleted it), but I got stuck at the HitmanPro part. It scanned my computer and found 25 malicious files, but it won’t remove them for me. There was no “Acitvate Free License”; the only option is to buy the product. I tried running it again, and this time noticed that on the bottom there’s a warning sign and next to it, it says “Trial license expired. Removal of viruses and other malicious software is disabled. Buy Now”. Seeing as I prefer not to buy the product, I was wondering how you suggest I proceed? Should I do Step 7 with Rogue Killer, or do I first need to complete the HitmanPro step? And how can I get rid of those 25 malicious files?
Please instruct me on what to do next.
Thanks
Hello,
HitmanPro and Malwarebytes should have removed this rogue antivirus,however for your peace of mind I would suggest that you perform a scan with the following utilities:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Thank yoU!!!
Thanks a lot Stelian. I’ll do so.
Kindest Regards,
Eloy
Seville
omg…thank you soooooo much. I spent nearly 1 day trying to remove (several boot cd’s etc.) that frigging malware until I found your post. THANK YOU!
Still one question: Should I reinstall my OS to be 100% sure that this malware is gone?
Hello Eloy,
Your Combofix log shows that you’ve still got some infection on this machine.Can you please start a thread in our Malware Removal Assistance forum as we need to remove this viruses.
Hello Cristy,
You can ignore that alert…Internet Explorer has displayed that alert because this file isn’t commonly downloaded …
Also:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Thank you so much! This all worked great right up to the last step. Windows will not allow me to download Roguekiller. I am not given an option like do you want to download anyway….it just will not let me, saying it is unsafe. Is there another option/program?
I am starting a thread and I have read your blog and saved it! :) But…..I’m not sure what I’m supposed to put on the thread…..
I will try not to meet again on here! :)
Hi Stelian,
Thanks a lot for your answer and your attention. I followed your instructions closely and ran ComboFix and ESSET Online Scanner. The report created by ComboFix is to be found at the end of my this post. As for ESSET Online Scanner, it didn’t find any threat. However, as I described in my previous post, I’m still unable to install Kaspersky Internet Security 2011. In the middle of the process, I get an unexpected black screen and a sudden reboot. When I try to install Kaspersky Internet Security 2013, I still get a report stating that my PC could be infected and am recommended to scan my system with Kaspersky Virus Removal Tool. Something new happens now: Kaspersky Virus Removal Tool cannot be run now as I also get a black screen and a reboot when I try to install it. I hope you can help me with this. Many thanks in advance.
Best regards,
Eloy
Seville
Spain
COMBOFIX REPORT *****************************************
Hello Eloy,
Can you please run a scan with Combofix and ESET online scanner and post the logs here so that I can get an idea on what’s going on :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok and the logs from this utilit
Yes,run a scan with Malwarebytes and then go ahead with the HitmanPro scan… keep me up-to-date with what’s going on!:)
can i do this step on safe mode ? im using windows xp
– i already done the STEP 5: Remove Live Security Platinum malicious files with Malwarebytes Anti-Malware FREE coz i had the software before this sh*t virus infected
Hi Stelian,
Great job!!! Thanks for your post. I still need some help. Hope you can answer. I got my office’s computer infected with the Live Security Platinum one week ago and tried to remove it with my usual desinfection tool, Kaspersky Antivirus 2011. I scanned my pc with this application, which detected the virus and seemed to delete it. But whenever I restarted my computer, I still got messages from Platinum still working and downslowing my system. Then I scanned my PC with Kaspersky Virus Removal Tool and this detected a lot of infections and got rid of them. At that moment I thought my computer was already clean, but after the following restart, Kaspersky Antivirus 2011 collapsed. It stopped working. and did not started any more. I was advised to reinstall it. However, that has turned to be impossible, as during the setup process, I always get a black screen and the computer switches off all of a sudden. This continues to happen: whenever I try to install Kaspersky Antivirus 2011, my computer switches off and never get the chance to finish setup. Yesterday, I installed Kaspersky Internet Security 2013, but during the process I got a message reporting that my computer may be infected and wassuggested to download Kaspersky Virus Removal Tool. I downloaded this tool again and scanned my computer, but on this occasion it didn’t find any virus. Every time I install Kaspersky Internet Security 2013 (complete installation is possible) I get this message reporting possible infection. And every time I try to install Kaspersky Antivirus 2011, I get a black screen and my PC goes down. Could you please help me with any suggestion? Thanks a lot.
Best regards from Seville, Spain
Hello Jodi,
That alert is most likely generated by Live Security Platinum!
Anyway,here is how you can create your own registryfix.reg :
1.Create and run your registryfix.reg
A.Copy all the text in bold below and paste to Notepad/Text Document
B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)
C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.
NEXT,follow the guide to remove the malicious file from your computer.
Good luck!
Hello Barry,
Exactly what’s happening…This infection has compromised your firewall… Please uninstall your firewall and run the below scans:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Hello jiwan,
Can you perform a scan with the following utilities:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
VERY IMPORTANT!: NEXT,please delete Combofix from your desktop and download a fresh copy of this utility.After you have disabled your antivirus,run a scan with Combofix and post the log here.
Hi i had this problem and my friend recomended to install malwarebytes and it removed the malware, so then i uninstall malwarebytes but on the next day the malware still showed up. Again i had to install the malwarebyted and it removed the malware i also used comboflix. Still on the lower right when i click customize it shows something like 9d62tmp. live security premium. Please help me to completely remove it
Thanx
nevermind it had something to do with firewall i guess.
Thanks for the help. Got through all the steps and I seem to be doing ok except 1 major problem.
I cannot run any programs that require connecting to the internet after login and username. For example Tweetdeck or Thinkorswim.
Unable to connect. Please check your network.
The link that you have provided on step 3 for the Registryfix.reg download link doesn’t work for me. :/ It says it was blocked due to containing walware and exploits. How exactly does this virus get into a computer? Because I don’t download any programs on this laptop ever. I save a few pictures, but that’s about it. :(
What type of error do you get when trying to download this utility?Can you try to download RogueKiller from here,if it doesn’t work then go ahead with the below steps:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
My computer won’t let me d/l roguekiller..
you are the best, great instructions and worked like a charm, thank you very much
Thanks from my 13 year old son! He got Live Security and this has been a great step by step to follow. All seems fine now. Took some time, but worth it!
Thank you very much, you save my lap…
Hello nat,
Read the guide above and you’ll get rid of this fake antivirus! :)
Hello JohnnyW,
Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Thanks !
Hi, Stelian. My problem is still exist, hope you can me some advice.
I followed your Step 1 to Step 6, so that my PC got back to Internet and IE browsing. Unfortunately when I conducted Step 7 Roguekiller, I got blue Screen when the program started prescan. Then I tried ESET Online Scanner and it cleared 10 files with threads. But I still encounter same problem when I conducted Roguekiller, I worry about the status of my PC, is it safe to use? What else can I do? Please give your expert comment, thanks.
I followed your step by step process and it worked magically to remove a virus called “Live Security Platinum” fake software that took over my computer instantly! I am blessed to have found your site.
Thanks for all you do!
Jerry Kelly
hello i was wondering if anyone can help me. live security platinum virus appears to have taken over my laptop. i have started it in safemode and can now finally access the internet however i have no clue how to remove it. i tried to unistall it but this did not work. i have read numerous posts on ways to remove it by downloading things and typing in stuff but it all seems complicated to me (im not the best with technology) can anyone explain and give me an easy method to get rid of this horrible virus? thank you
For some weird reason i didn’t do all of those things mentioned above…i tried the old skool ways lol….shut down my modem and let the PC running without any internet connection whatsoever, i just right clicked the Platinum AV icon on my desktop and open File Location, delete any files related to this crap fake AV. eventho u CAN’T delete the whole files on that folder (3 files listed inside the folder), but you CAN delete 2 of them, except the main Platinum AV.exe file. Once you delete those files turn your PC off, completely OFF!!. Turn it back on after a while and put your internet back on and download SUPERantispyware and Malwarebytes’ Anti-Malware to your PC, install them apps and run complete scan with both applications just to make sure your PC is clean from the virus. Restart your PC and it should running without any problem.
I know it looks simple and very old skool, but it worked! i’m running Windows 7 Ultimate x64.
Good luck folks..
Hello aisling,
Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Cheers Stelian, this was great to follow and heaps of help, now I should ban my wife from using the computer.
thanks again
fake alerts keep coming up though i have done everything
Hello Nichole,
You can ignore that alert .. The program is safe otherwise I wouldn’t recommended :)
THANK YOU…………………..
was just doing some work at home in the office and the Live-Security-Platnium somehow started ans in less than 4 mins i could not use anything on my laptop.
luckily a had my mac for other programs i used and googled the damn thing.
i looked at a couple links and yours loked the best.
I tried everything you said and it all worked great except for “Rogue Killer” I was unable to download or open it.
Anyway, all is GREAT and working again.
THANKS A MILLION
thanks, iam linux but my mom no :/ very useffuly!
Thanks a lot. You should be nominated for the Nobel-price.
Thanks for sharing! I am having trouble with step 7, RogueKIller. My computer is saying it is not commonly downloaded and could harm computer. It won’t let me run this. Should I save? Try another Roguekiller ???
same thing happened with me, just did everything in safe mode up until the hitman pro im pretty sure
Thankyou soooooo much !!!
was in the middle of doing a high school certificate assignment when the stupid live whatever platnum crap appeared !!
not sure what that last stuff did though – the rogue killer stuff
but im just glad the virus is gone.
again thanks so much for this ! youre a legend !!!
You are a life saver. Thank you so much for this!
I followed your instructions and my computer works fine again.
Thanks a lot..Wonderful Guide.
Hi,
Thanks so much. I think it works. I followed all the steps, but when doing step 6 onwards I still had to stay in safe mode. When I tried running the computer in normal mode after the anti-malware scan (step 5), live security platinum was still running. I wanted to check that doing step 6 onwards in safe mode is ok, or do I need to do something else. Now, after haveing done all the steps, I am able to work in normal mode fine.
Again, thanks a lot. You’re a savior!
Hello Jessica,
The RogueKiller log looks good…..Unless you are having other problems, it is time to do the final steps.
Delete the following folders: (If they exist)
C:\ComboFix
C:\Qoobox
You should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions.
Hello Katherine,
Can you please run a scan with RogueKiller (Instructions on STEP 7) and then try to run the Malwarebytes scan.
If you are still having issues reply back and I’ll help you with further instructions.
When I try running Malwarebytes again it always freezes up at the same point. Also it seems that Rkill didn’t terminate any processes.
Hi. Malwarebytes ran for about 20 minutes, didn’t detect any objects yet and then froze up before it finished. Do you know how I can fix this problem?
Thanks
Katherine
Without you I’m nothing!
the perfect guide to how to!
a 1000 time thank you!
I now have internet access! There aren’t enough words to express my gratitude for your help. You are a special person for helping us non-techies.
I am posting the RK log below, it did say I have an infection.
Do I delete the RK quarantine file?
ESET came back with no infections as well.
RK log:
RogueKiller V8.0.0 [08/26/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com
Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Mama Bear [Admin rights]
Mode : Shortcuts HJfix — Date : 08/27/2012 08:06:18
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 9 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 86 / Fail 0
My documents: Success 117 / Fail 117
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 138 / Fail 0
Backup: [NOT FOUND]
Drives:
[C:] \Device\HarddiskVolume1 — 0x3 –> Restored
[D:] \Device\CdRom0 — 0x5 –> Skipped
¤¤¤ Infection : ¤¤¤
Finished : <>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
Dude!!! Thanx alot!! You managed to save my computer while I am in the bush!!!
Well done and thanx again!!!
Lets try another thing…Can you please disable McAfee (Firewall and Antivirius) and see if you’ve got back your internet connection….
I briefly had an internet connection but lost it before I could download and run Rogue Killer and ESET.
Should I ‘re copy and run Combo fix again?
Ok Jessica, we are making a good progress …. Can you please run a scan with RogueKiller and then run the Complete Internet Repair utility as seen in my previous reply….
Good luck!
Thank you for the reassurance and patience. The scan ran and generated a log but still cant’t access the internet. I also noticed a red “shield” with a pop-up saying my computer is at risk b/c McAfee is off. It was not from McAfee (I didn’t click on it) Below is the combo fix log report It is lage:
ComboFix 12-08-25.04 – Mama Bear 08/26/2012 10:09:33.1.2 – x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1579 [GMT -4:00]
Running from: c:\documents and settings\Mama Bear\Desktop\Combo-Fix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
——–><----
Hello Jessica,
Can you please let the scan run , you shouldn’t lose any files… The scan will go up to Stage 50 and then it will generate a log…..
Hi. I downloaded combo fix to a thumb drive, copied it to the infected computer and double clicked after closing all virus protection. I received an error message about needing updating for windows restore before the program would continue. Iclicked ok to connet to the internet for update. another message saying no connection. I hit “x” since it said it wouldn’t work but then it started running looking for malware and I am concerned that nor restore point has been set and I will loose everything. I had only partially been able to back-up files. waiting for money to buy a new back-up drive.
I captured the message with a screen shot but I don’t know how to upload it. is all lost?
Current message 2 sreens, On blue background screen “completed stage 2” and gray error message says “failed to download required files. Aborting….Shall continue scanning for malware” I have NOT clicked ok yet.
No,it’s not normal the Combofix scan should not take more than 10 to 20 minutes….
Can you please run a scan with RogueKiller and post the log here….
Unless you are having other problems, it is time to do the final steps.
Delete the following folders: (If they exist)
C:\ComboFix
C:\Qoobox
You should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions.
And I used Hitman Pro as well (Safe Mode too). :)
Hi again, Thanks so much for the prompt reply. After leaving a comment here, I looked through the comments here and decided to try ComboFix, Rogue Killer and Complete Internet Repair Utility (in this order) in Safe Mode with Networking. I then restarted normally (without Safe Mode) and my computer seems to be working fine. Should I still repeat the actions in your comment above? Please let me know if you would like the logs as well. Thanks heaps and much appreciated.
hi…after ComboFix rebooted my computer, a ComboFix window popped up saying “Please wait.” and it has been like that for at least an hour now…is this normal? thanks.
Just wanted to say a big THANKYOU for your instructions – removed the virus, no problem!
Hello Noelle,
Can you please use this license key ( AA39754E-715219CE ) to register this fake antivirus (so that you’ll get back your Internet connection) and then run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with RogueKiller
RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
STEP 3: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hi, Thanks for this guide. I did Step 1 to 5. However, when the computer restarted normally, it was still the same as before. It wouldn’t let me use the Internet and there were still the Live Security Platinum Virus doing its scans etc. :( What should I do? Thanks heaps.
Thanks a lot, the tut it’s so easy!
thanks for all.
Hello Jessica,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with RogueKiller
RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
STEP 3: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run the below utility:
Download and run the Complete Internet Repair utility.
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hello Alfredo,
Yes,you can delete or uninstall all the tools that we’ve used!
Stay safe!
Can I delete the “rkill’ folder and txts, as well as the “RK_Quarantine” folder and “RKreport” txts after I finish the entire process? Thanks a lot, your guide was super helpful.
Thank you! We were able to fix my son’s computer with this guide. Now my computer is infected with something because I suddenly can’t access the internet. I went to your regular malware removal guide but can’t get past the step where I turn off the proxy server. Even after a reboot (to safe mode) I still can’t access the internet. Please help!
Thanks for the great tutorial. Work fantastic! Keep up the good work.
THANK YOU!
Thank you!!!!
Thank you so much for your advice. The problem seems to have been solved for now and my machine is working normally.
awesome!you are awesome!this is awesome!
THANK YOU!
Amazing! Really usefull. Thank you.
I followed your instructions and it worked for me! Thank you so much!!! <3
PS. Live Security Platinum popped up on my computer shortly afer I downloaded Skype.
Don’t worry about that just go ahead with the scan…. If you need to reboot then please run again RKILL……
NEXT,please follow this steps and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with RogueKiller
RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
STEP 3: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hello Alex,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with RogueKiller
RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
STEP 3: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
My free trial license for Hitman Pro has expired
I have completed all other steps
Can I use any other software?
Awsome, problem fixed. ty
Dear Stelian,
I have this virus and am very new to all this, so please forgive my ignorance. I followed your instructions until STEP 5, no.3 i.e. to download and install Malwarebytes Anti-Malware (MBAM). However, I mistakenly altered the default settings for installation by selecting the “Create a Quick Launch icon” option and this led to installation. Once I reached the “Finish” window, there were 3 options which were selected (I cannot remember exactly what was the 3rd one). I tried to uninstall MBAM and download it again but it did not take me further without having to reboot my laptop for the uninstallation and the re-installation to take effect. As you advised, I did NOT reboot. When I clicked the MBAM icon saved in my folders, a window popped up stating “Run-time error ‘339’: Component ‘vbalsgrid6.ocx’ or one of its dependencies not correctly registered: a file is missing or invalid”
Can you please advise me on how I can get out of this mess? Thanks, MUKit
Hello Suman,
Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with RogueKiller
RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
STEP 3: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hi I actually had this live security platinum virus and I somehow got rid of this by some sort of malware. But I still feel like Live security platinum virus is still around. My HP laptop has HP icon with live security symbol on it. Does tht mean the virus has gone off or still on my laptop. Because my wirelss connection drops out often and there is something else between my internet connection and the internet. Please help me with this problem.
Worked perfectly, thanks!
Thank you thank you thank you!!! It works
Thank you Stelian!!
Thanks for the help :)
Worked like a charm, the guide was really easy and well written
Hello Angel,
Yes,even after you’ve enter the activation code ,you will still need to remove this infection!….
If I enter the code registration code would I still be able to delete it once I do all the steps?
Thankyou so much for your how to on this little bug. I got this virus just after accepting a conformation of adobe flash update. I disregarded any concerns because three of my other office computers all had an update for adobe.
Again many thanks for your effort in providing a very easy walk through :)
You had a lot of malicious files on your computer……Please take better care of it from now on….
Ok,now lets uninstall Combofix:
Delete the following folders: (If they exist)
C:\ComboFix
C:\Qoobox
You should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions.
It finally worked!!! Thanks so much. Here’s the two different logs I saved:
ComboFix 12-08-14.05 – Sandi 08/15/2012 12:19:28.1.2 – x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4093.2325 [GMT -4:00]
Running from: c:\users\Sandi\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
Sandi,can you please run a scan with Combofix and ESET online scanner and post the logs here, so that I can get a log of your computer… :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
While in Normal Mode, can you connect to the Internet?
Also what type of internet connection do you have?
Hello Aasheesh Chhiber,
Can you please run a scan with Combofix and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Next,please run HitmanPro and Malwarebytes as seen on the guide.
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Still not working!!!! Please make my computer happy!!!
It seems like that everything is working perfectly,
Thank you!
Hello Magnus,
You computer is safe,Qoobox is just the quarantine folder of Combofix…… so you can delete it.
Please uninstall Combofix:
Delete the following folders: (If they exist)
C:\ComboFix
C:\Qoobox
Next,you can uninstall all the files that we’ve used in the Malware Removal Process… Stay safe!
Hi – I tried all 12 files of Malware Chameleon and while a MS-DOS command window opened in each, it indicated that a protective driver was missing and it needed a reboot to install that. Once a reboot occured (I tried both safe and normal modes), 2 error messages popped up related to a path not being found after which nothing happened. Can you please help?
Hi Stelian. You helped me get rid of the Live Security Platinum Virus about 2 and a half weeks ago. As I was looking through my files on my computer, I found a folder in Local Disc (C:) called ‘Qoobox’, which has in it a ComboFix quarantine log and a Quarantine folder that has .vir files. Can I delete them? Isn’t that the virus files?
Also, can I delete Malwarebytes from my computer? Can I remove HitmanPro, iExplorer, registryfix, ESET, and Kaspersky setup?
Hello Matt,
Can you please follow the below steps:
strong>STEP 1: Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
STEP 2: Run a scan with RogueKiller
[b]RogueKiller Download Link[/b] (This link will automatically download RogueKiller on your computer)
STEP 3 Please perform a scan with HitmanPro as seen on the guide.
If you are having problems starting this program please use the ForceBreach mode as described in the guide.
STEP 4: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is running!
Good luck…
Hello Pranav,
I’m happy that you manage to remove this infection…AND you DON’T need to send me any money… Just stay safe and have an awesome life… :D
Great!
Now, please follow the below steps:
Step 1: Run a scan with RogueKiller
[b]RogueKiller Download Link[/b] (This link will automatically download RogueKiller on your computer)
The report has been created on the desktop.In your next reply please post:
[b]All RKreport.txt [/b] text files located on your desktop.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working…
I’ve come across a problem at step 4. I use the Rkill, which you say I shouldn’t reboot once it’s done, but the program will restart my computer without any choice. Is there a way to stop this?
Thank you very much!
You saved my computer.
Should I still run Hitman Pro? I couldn’t since I was disconnected from the internet.
Thank you again!
Wow. You are a life saver. I can’t believe I was able to follow someone instructions and actually perform all the steps without complications (as what usually happens because either it is a step by step video on youtube or elsewhere which goes too quickly and you constantly have to pause, or they miss a step in written instructions and things don’t work out). I should send you some money because I would have had to taken my laptop somewhere to get it fixed.
Thank you so much! Your steps worked perfectly!
Hi Stelian,
I have tried the RKill but it didn’t work so I proceeded to ran the combofix and it seems successfully deleted “something” (I am not sure) so I paste the combofix log as follows:
c:\programdata\Windows
c:\programdata\Windows\ccdxmmde.dat
c:\programdata\Windows\drss.dat
c:\programdata\Windows\xessmsxe.dat
c:\users\dinah yunitawati\AppData\Roaming\Ceufo
c:\users\dinah yunitawati\AppData\Roaming\Ceufo\uroc.gaw
c:\users\dinah yunitawati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
c:\users\dinah yunitawati\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk
c:\users\dinah yunitawati\AppData\Roaming\mscre.dll
c:\users\dinah yunitawati\Desktop\Live Security Platinum.lnk
c:\windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@
c:\windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U0000001.@
c:\windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\80000000.@
c:\windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\800000cb.@
F:\install.exe
.
Infected copy of c:\windows\system32\services.exe was found and disinfected
Restored copy from – c:\32788r22fwjfw\HarddiskVolumeShadowCopy3_!Windows!System32!services.exe
However, when I tried to run the Malwarebytes, I didn’t get any Internet connections and I tried Complete Internet Repair utility and still I can’t connect to the internet. any other ways to fix my laptop? Appreciated much.Thanks.
PS: a bit background info for you, hope it’s helping you to analyze my problem :P : My OS is Win 7 Premium, Laptop Dell Inspiron 13R; I can’t enter BIOS and Safe Mode by pressing F8, the latter only worked through msconfig when I don’t connect to the internet.
You pretty much saved the day.
Hello Sarah,
Can you please run a scan with Combofix and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hello Shelly,
Can you please run a scan with Combofix and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
Hello,
Lets try to see if we can fix this :
Get a USB stick and copy on it Combofix, then transfer it to the infected computer and perform the following steps:
Please read and follow all the steps very carefully.
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
Please add the log that Combofix will produce in your next reply.
STEP 2 : Download and run the Complete Internet Repair utility.
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
Let me know if this fixed the problem…
Hello,
Thank you so much for the instructions!
I have one minor problem though.
After Step 5 (Running Malwarebytes Anti-Malware) and restarting my lap top I can’t access internet. This is strange, since my network setting say that I am connected. McAffee says that I don’t have any problems also.
Could you please help?
Thanks.
Hi Stelian,
Thanks for the great tutorial. I’m bookmarking this site in case something like this happens in the future. I was able to get through all the steps and get rid of the malware. But, when I opened back up in Regular mode and downloaded Hitman Pro I see that at some point (probably when we had another virus) my husband has already used a 30 day trial of Hitman Pro. So, while it did let me do a scan (and found several Trojan, Virus, etc. files that no other program has found) I cannot remove them since I can’t activate a free trial (and don’t really want to spend $20 on it since I’m not currently working. Is there another program I can run that may have better luck finding these files (Malwarebytes isn’t finding them, neither is AVG or Avira Anti-Vir). Thanks in advance for your help!
Shelly
I found this, as it appeared to be the exact problem I was having. Hitman Pro was successful, however, I am once again trying to run RKill, in normal mode, exactly as it is stated above, and I keep getting the same “critical error automatically restarting in 1 minute please save work” message. What else can I do??
Thanks Bro… :)
Please run a Combofix scan and post the log here!…
Good luck!
Hi again,
Many thanx… everything went well and my security is back on.
You are the modern day Tim Berners-Lee of computer repair :)
I extend my sincerest thanks and gratitude.
Regards,
Steve
I have the same problem. I only got connection with docp, when i put in the ip adress manually, the computer dont got connection.
Hello John,
Please read and follow all the steps very carefully.
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
Next, please post the log back here and let me know how things are running.
All right, I have everything working again. I had to restart my computer and Combo Fix decided to work that time. I had to be patient and give it some time to work. Whatever infected me really slowed things down. Combo Fix patched up services.exe which was great. MalwareBytes found some things, and HitmanPro found a lot of trackers and stuff embedded into Firefox. My internet was taking forever to load websites and I suppose that was the cure. ESET also found a few items. All of this headache from Live Security Platinum.
I browse and open tabs constantly and sometimes don’t take the time to read every pop-up because usually it’s the same stuff like Adobe updates or Java updates or other junk I don’t want to deal with at the moment. I think Live Security Platinum disguised itself as an Adobe update because I had a bad feeling about accidentally clicking on that one.
Anyway, thanks for your sevice to me and everyone else on here! It seems to be impossible to dig up info on services.exe that was written in the last year or so.
I followed your guide exactly how it was written, even your further replies to other people’s posts. I can run Eset and hitman pro when I am in safemode, when I am in normal mode it says I am not connected to the internet. However, I can access the internet via IE but not Mozilla. I set the proxy settings exactly how you said to do them. In safe mode Mozilla runs perfectly fine, the issue is when I get into normal mode when things start to mess up.
Thank you for this guide, any and all further help would be appreciated.
Can you please run Malwarebytes Chameleon and then do the Combofix scan….You have the instructions in my previous post.
I downloaded ComboFix onto the desktop, renaming it Combo-Fix. When I run it, it extracts a lot of files and then closes. I get no further prompts or anything. I’m just back at the desktop like nothing happened. There is no new program in my start menu or anything. What should I do?
Hello,
Please read and follow all the steps very carefully.
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
2.Run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
3.Please perform a scan with HitmanPro as seen on the guide.
4.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is running!
Good luck…
Hi Stelian. I tried following the instructions but I can’t get past the rkill.exe stage. When rkill.exe runs, I get a dialogue box saying the computer has to restart. I have no choice in this matter and the computer restarts in a minute or so. There is clearly a problem with services.exe because it gets terminated in the rkill log, and AVG keeps telling me it’s a trojan about every hour. AVG does not give the choice to remove it. Only to ignore it.
So how do I fix services.exe, and how do I run rkill.exe without it automatically rebooting the computer?
Hello Kobus,
If you can’t back-up your files than you can just go on with the instructions…You should be ok…
You can follow this steps:
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is running!
Good luck…
Hi
I am reading this on another PC as I cant manage anything from mine.
I will print this and try at my infected PC.
I am not able to back-up or copy any of my data or photos in normal mode or safe mode.
Can I start the process before backing-up or is this risky?
Kind regards
Kobus
Hi Stelian,
Thanks very much for creating an excellent tutorial that allowed me to successfully remove the Live Security Platinum malware/virus off my laptop.
With great appreciation
Hal
All the tools that I recommend are safe to use… Just ignore that warning and download and run those files. :)
Hi Stelian, thank you again for taking the time to offer me advice on how to sort out my security issues… However when I tried to run rogue killer and the windows repair all in one my sysyem is advicing that I dont install ” rogue killer and window aio repair is not commonly downloaded and could harm your computer “… What do you advise I do?
Thanks again,
Steve
Thank you very much. ขอบคุณครับ
Hello Sandi,
Can you try this steps:
1. Click the Start buton
2. Type “cmd” in the Search Box and then press Enter
3. Right-click “cmd.exe” and select “Run as administrator”
4. Click “Continue” on the “User Account Control” Window
5. In the command prompt type the following command
sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
6.Restart your computer and check if the problem is solved.
Hello Peter,
Lets try to see if we can fix this.Can you please run a scan with Combofix.
Please read and follow all the steps very carefully.
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2 : Download and run the Complete Internet Repair utility.
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
Let me know if this fixed the problem…
Hello,
Can you please run a scan with Combofix and ESET online scanner and post the logs here :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok ..
Hello Steve,
Lets try to fix this.
First run a scan with RogueKiller:
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
Next, download Windows Repair All In One and install this utility.
Go to the Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
Note: Leave everything else unchecked
Let me know everything goes…:D
Thank you very much. You’ve saved my computer and my life :-)
Hi Stelian,
Firstly, thanks for this great advice on the removal of this nasty.
Since using the removal advice though, I can’t seem to turn on my Security in the Security Center… Any ideas would be well appreciated.
Cheers again
Hey, the removal process went perfectly however, now my computer has really slowed down and I cant figure out how to remove the rkill from my system. I’ve already tried the steps suggested to another comment about the speed of their machine but, those haven’t helped from what I can tell. Any more advice is greatly appreciated!
i tried to work in normal mode to go through the chameleon steps but in normal mode i cant use the internet, so i tried to do it in safe mode.. once i tried using the chameleon link a box popped up with files. one had a yellow question mark and the other had the black DOS next to it. i clicked on that one and it said i would have to execute files in order for it to install properly. I clicked execute and it left me with one file, the mbam chameleon. now i dont know what to do..
Hello,
Hello TJ,
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
Please post the log in your reply and details on how your computer is running.
Hello Allison,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
After I run RKill and after it completes my computer automatically shuts down. Is there a way to stop this? My computer tells me it’s going to shut down in 1 minute and there isn’t a cancel button.. Can you help me with this?
Hello Stelian, I have been trying to overcome this nasty virus for 3 days now and i’ve been able to get it to stop running in normal mode thanks to your advice. But now when I enter normal mode my computer is very slow (also when starting up) and I can maybe use the internet for maybe 5 minutes before it randomly stops responding along with the desktop, making normal mode unusable. I have used almost every scanner available and have been able to remove some of the viruses. I then ran full scans afterwards and have not been able to detect anymore viruses, but i’m not sure what to do next as I cannot use normal mode since my whole desktop will stop responding. I need you’re advice!
Got rid of it !!!
Hello John,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Hi,i can’t start my computer in Safe Mode with Networking or only Safe Mode.Perheps it’s stoped by the virus.Thank U very much!
Hello,
Yes, you can uninstall HitmanPro is that’s what you want!:)
Thank you very much, Stelian. This info helped me incredibly. Is it OK if I uninstall Hitman Pro and so on now that my laptop’s clean already?
I’ve also updated Adobe a few hours before this malware stroke, BTW.
Thanks again:)
I did this, tried both methods offered but neither worked. I don’t have the “Background intelligent transfer service” that it says to click on. What now? Thanks
Hello Debra,
Can you please try to start MS Outlook from it’s folder…..
Hi – thanks for your free guide to remove this virus. Seems to have worked on my laptop however now that I’ve rebooted I can’t get MS Outlook to launch. I click on the shortcut and nothing happens? if you have any advice, I’d be grateful. thanks
i ahve very little computer knowledge and i followed these instructions and removed this virus. i had an adobe flash player update and clicked it and believe that is where i got this virus.
you should have a donation link for people to send you money if they want. i’d send some to you.
thanks, gary
Muchas gracias Stelian. Just removed this virus from my computer thanks to your guide. It’s so very kind and generous of you to help us all gratis.
Man, this is why internet is absolutely amazing! Precious FREE information for real troubles!
Thanks so much for your assistance. Managed to get rid of Live Premium virus with the first part of your help
Please run this two scans :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your machine is ok ..
Hello John,
No, you can remove all the tools that we’ve used! :)
Stay safe!
The original post worked well and purged all malware off my system. Thanks for the instructions – they saved my computer and academic career.
Dude! You are a legend!!!!!!!
Just restored my faith in human kind, so stoked people like you exist and want to help people for nothing in return… good on you and keep up the good work, I now have no more viruses thanks to you.
Cheers Wes
If I remove the programs you said to download after I am finished, will it cause any problems?
not sure if you got my last message because i cant see it, i havent been able to remove it completely from my computer, plz help
just a while ago my pc got infected by Live Security Platinum and everything in my pc frozed and admittedly i have no idea what to do but luckily and glad i found this site and just followed the direction carefully and it does help me back on track using my pc as if theres nothing happened. im so glad that helps comes in a site like this and all i can say is THANK YOU!
Helo,
1.Run a scan with RogueKiller
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Let me know how is your computer running!
Hello alissa,
Lets work in NORMAL MODE to see if we can get around this :
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Hello,
Please download and scan with Malwarebytes and HItmanPro, just to make sure everything is ok!:)
This tutorial works on my laptop. But, why are my laptop runs slower than before infected? Could you please give some advice? Thanks for your hard work on this tutorial.
Not trying to be a smart ass, but I put the registration for security platinum and did a system restore from 2 days before the problem happened, all gone, never existed…Any collateral effects doing this?
and when i do the rkill it says nothing detected and then reboots my cpu after 1 minute
i cannot get the rkill icon to appear on my desktop….
Thenk you sooooooo mutch!!!!
Hello John,
Here is the direct download link : http://malwaretips.com/attachment.php?aid=1000
Alternatively ,you can create your own registrfix…Here is how:
A.Copy all the text in bold below and paste to Notepad/Text Document
B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)
C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.
Im on step 3 asabove but i cant find the REGISTRYFIX.REG DOWNLOAD LINK…please help
Hello Roger,
Yes,if you have an older version of Java or Adobe is very possible to be infected by an exploit or drive-by.
You can watch these videos to better understand this process :
http://www.youtube.com/watch?v=_cBed6-ufIQ&feature=plcp
http://www.youtube.com/watch?v=K3TeUzPkO-o&feature=plcp
thanks a lot, it worked!
on a side note im pretty sure i got the virus throgh a link that a random person sent me on youtube. this may seem like a stupid question (maybe it is!) but is it possable to get a virus just while looking at a website like without downloading anything?
Thanks so much, my computer works again.
Hello,
Can you please try to run a Combofix scan?
Please read and follow all the steps very carefully.
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
Next,please re-run the Complete Internet Repair utility as seen on my previous post.
Waiting for your reply to tell me if your machine is now ok.
The combination of Malware Bytes and Hitman cleared not only this virus but every other little-lurking-evil-virus-of-evilness from my friends Laptop.
Fantastic! Thank you very very much!
It didn’t. It connects for a few seconds and then I get ‘server not found’ and/or ‘the connection has timed out’.
Oh my! my computer is normal now!
I just followed each step and got out of the nightmare.
Thanks a lot!
Thank you so much, this worked perfectly and your instructions were great!
Hello,
Lets try another way around this :
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes and then do a RogueKiller and Unhide.exe scan as seen on the guide
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Hello,
Can you please run this utility:
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
Let me know if this fixed the problem…
Awesome it really worked, thanks man.
My computer was recently infected with this virus. I just wanted to say that I was able to remove the virus by using JUST HitmanPro, and none of the other programs like Malwarebytes. All I did was run a scan with HitmanPro while IN safe mode, and it found a suspicious file that it deleted. After that, my computer worked fine. =) Just wanted to add that I didn’t need to use any other programs to remove it.
100% Satisfaction. Thank You.
I was recently infected with the Live Security Platinum malicious program. I managed to remove it but something is blocking my access to the Internet. I contacted my ISP and everything is working on their end. I have checked the Windows firewall, which is off, (I have Windows Vista) and my anti virus firewall and neither is blocking Firefox. I don’t use IE but I can’t access the Internet on that one either. I have checked the proxy settings on both following the instructions you provided and nothing. I’m thinking I should restart my computer in ‘Safe Mode with Networking’ and run Malware bytes. But now I’m afraid to download anything because that’s how I got infected in the first place. Through a fake update. Any help will be greatly appreciated. Thanks in advance!
So I get all the way to step #4 (Run RKill) and it works…the only problem is I get a window that pops up and says: Windows has encountered a critical problem and will automatically restart in one minute. Please save your work now.
I dont have enough time to finish your process before windows reboots. It happens everytime RKill finishes running. Im using Win 7 x64
:(
Thank you sooo much. You are indeed a lifesaver! :)
Can you please run this utility:
1.Download Complete Internet Repair utilityto your desktop
2.Unzip all the files to their own folder on the desktop
3.Within the folder double click CIntRep
4.Select the following items,then press the GO button.
Can you please try to follow the steps from this guide to fix your Windows Update problem: http://support.microsoft.com/kb/956706
Hello,
While in Norman Mode , can you connect to the Internet?If yes,please follow this steps:
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes and then do a RogueKiller and Unhide.exe scan as seen on the guide
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Thank you so much!!!!!!!!!1
Thank you! This was perfect! I appreciate it.
Hi, my wifes computer got infected with Live Security Platinum and I was unable to access the internet from her computer in safety mode. I ran rkill and Malware and the computer restarted. I downloaded all the required software from my computer and transfered it with a memory stick. When i start in normal mode the LSP starts again. I tried starting HitmanPro in safety breach but it tries to connect to the internet. I dont know what to do now. Im using windows XP. Please help my wife needs the computer for her work.
Hello,
I advise you to remove McAfee and install another security product because McAfee is not that great..
Quick tips;
Free – Avast 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012 or Avast Internet Security 7
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
Thank you so much my computer is back to normal now xx
Thanks man, what a lifesaver. May you be blessed enormously with offspring and may your path be guided by the heavenly father.
Also, i’ve just tried fixing the dhcp service. Running vista. Went to control panel-system & maintenance-administrative tools. The went to open “services” and got this message: “the specified service does not exist as an installed service”
No luck. I was able to run the karversky10 disk and it removed one theat. However i still can’t access internet. Same message – “the dhcp client service is not runnibg on this computer”. This is taking me hours and i can’t even get past step 1:(
Is a system restore a viable option?
Thank you very much!
I printed the instructions (all 57 pages) off of my daughter’s computer and found a comment from Dan W. on July 27, 2012 at 3:04 am who said that his windows update was no longer working. Mine isn’t either. I can’t access your response to him on my computer and clink on your direct link to the Windows Repair All In One. I was able to search for the RogueKiller and found what you pictured and took care of that part, but can’t find the other. Can you send me the link to the other? Other than that….I’m extremely happy I found this while searching for the removal….it worked! :) Thanks!
Thank you for these clear instruction and links.
McAfee failed to warn me of the infection and also to this day cannot detect it in a scan. They are, however, willing to charge me to have their people remove it for me. -Nice.
Best Buy wanted me to buy a $200 one-year subscription for them to remove it.
A million thanks my dearest! You are really a genius. How I wish more and more computer-skilled persons be like you, someone who uses his gift and skills in helping people unlike those who use their knowledge in creating problems, virus in particular. Thank you so much, you have no idea how much you’ve helped me… Your instructions are indeed concise and fantastic!!! Thanks….
Thanks much – great guide! Easy to follow and very effective.
Cheers,
Marl
You are truly a life-saver! Followed all the steps but couldn’t get RKill to work, but then I just looked at your reply to a comment below and voila!
Extremely happy that I can use my PC like nothing ever happened to it. Thank you so much!!!
Stelian, you are a star!
Thank you! :)
omg thanks its just showed up a few min ago
Please start a thread in our Malware Removal Assistance forum.
Hello,
The proxy box needs to be unchecked ,if it’s already unticked then just move ahead.
Regarding the .reg file,after you have created it or download it, right click on it and select “Open with” then select “Registry Editor”
Good luck!
thanks….
Hey, I have two questions.
On STEP 2 it says to uncheck the option “Use proxy server…”. However on your screen it is checked and you have checked “Automatic detect settings” and u have checked “bypass proxy server…” with the address of “xxx.xxx.xx”. Do you want us to copy what is on the screen or just uncheck the “use proxy server…” box. The reason I am asking, also, is because my box for “use proxy server…” was ALREADY unchecked.
Second Question:
When I download registryfix.reg it asks if i want to run it or save it. When i run it it just takes me to notepad. I then did what you asked for Ashley and saved it as fix.reg on desktop as “all files” however the same thing comes up and it just takes it to Notepad. Is there something I am doing wrong?
A reply would be much appreciated I need to get this virus out it is still intact in my office computer. THANK YOU.
Thanks so much, worked a treat :)
Thank you@@@!!!!!!!!!!!
Please run this two scans :
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your laptop is ok ..
Hello Gabe,
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
I am a Vietnam and I want to say “thank you very much!!!!!!”
Agreed! Awesome of you to take the time to help the technically challenged people!
i can’t download rkill!! Help please!!!
also in normal mode the Live platinum does not alow me to run Vodaphone and hitman seems to require internet connection to do a scan.
Hi i am using Vodaphone internet connection for my laptop, my computer is unable to sense the device in safe mode. I downloaded all the above softwares and the Malwarebyte found 200+ files so i removed them, when i restarted my com the @#$% live platinum was still there also i was unable to run Hitman pro… please help me – Ivor val.
Hello ashley,
Here is how you can create your own registryfix.reg :
1.Create and run your registryfix.reg
A.Copy all the text in bold below and paste to Notepad/Text Document
B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)
C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.
NEXT,follow the guide to remove the malicious file from your computer.
Good luck!
I’m having the same issue… but I also can’t download registryfix…. Argh, what do I do? Help! :(
Hi I am from a small cauntry named Israel, I have ziro knolage in computers. I wanted to say thank u so much for writing this gide so easy to use!!! Thank u thank u thank you!
Thanks so much for this guide! You are s lifesaver!
Hello waly,
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
I cannot run rkill in step 4. I tried everyway. renamed it to anything else. Downloaded it on this computer and transferred it to the infected computer through usb, but didn’t work.
Downloaded the other renamed versions as suggested here but still didn’t work
What am I supposed to do
Thank you for using your superpowers for good and not evil! So grateful to you.
Thank you so much for this guide. Helped a lot of people. :)
Thank you so much for this easy to follow and effective guide. I was panicking when the attack began and managed to clear everything with little fuss. Saved me !
Yes, I ran combo fix, allowed it to scan and restart and then I also used the ESET right after that. When I was finished with the two steps you gave me, ESET rebooted my computer and when it loaded into Windows Hitman Pro was still displaying that same message.
Really appreciate your help! All clean now.
Did you run Combofix as I’ve ask you to do??
i love you
THANK YOU!!! THANK YOU!!! My mother who is 73yr old, called to me know her comp was infected for a few days. So glad I found your link using my laptop and although it took two hours her comp is finally clean! I also have McAfee and wondered how she got this virus, then I noticed she was using the free wi-fi my complex offers. Hmmm… Again…
THANK YOU!!!!!!
Thanks for the great help!
By the way the registrycleaner.reg doesnt really work anymore i used glary soft registry repair(also free) and it worked fine!
Thank you so much for this guide! It was very helpful and much appreciated.
Thank you again,
Melissa
Okay! All that seems to have helped, and my antivirus software Vipre isn’t picking anything up, however Hitman Pro keeps coming up with this:
http://tinypic.com/r/9rr50n/6
Is there any concern? Hitman doesn’t seem to be able to remove the Ini virus.
Thanks so much for this! Worked like a charm!
Everything went perfect. THANK YOU VERY MUCH
Thanks for this great guide.
It helped me to fix the computer of my girlfriend.
greetz
Joerg
TOPS, MAN! TQVM:)
Thank you. Excelent guide, worked perfectly
Thanks for your advance sir.
I’m 18 years old korean. but I request sth to you.
Many korean need GREAT advise… like this your text.
but, sth korean can’t English very well… [like me. ;-(…)
I want to translate your text and teaching poors.
If you accept my request, plz answer my e-mail
Thanks for your reading.
The e-mail adress ; wjdtjsrl1@naver.com
Thanks a million! ComboFix worked; I believe it deleted the Live Security Platinum virus, and the ESET Online Scanner didn’t find any problems.
I just want to know, should I turn my firewalls back on? Also, should I do any more scans? I believe ComboFix deleted the Live Security Platinum virus, but should I scan for anything else? If yes, what should I do? Please advise. Should I follow any steps of your guide? And what about Malwarebytes Anti-Malware? Should I still have that on my computer or can I delete it? It didn’t work like it was supposed to, which is why I needed your other fix, but it did stop some malware attacks when I went online to follow some of your instructions (the first time around, before I asked you directly what to do), although I think that was the Live Security Platinum working, so now that it’s gone, can I delete Malwarebytes? Should I scan with it? Also, can I delete iExplorer, HitmanPro, esetsmartinstaller, Malwarebytes Anti-Malware, registryfix, and Combo-Fix?
And another thing. Before I asked you directly what to do, I was trying things that you mentioned to other people. I downloaded Kaspersky, but should I do anything with it? I don’t want to do things that are unnecessary, so can I just delete it?
Your advice is gold, and the user friendly, easy to follow instructions are awesome! I am a little knowledgeable in computers, but even so, the exacting, clear, instructions that you give are really, really helpful. It makes the whole process that much harder when the solution to one’s problem is in a hard to follow guide. You know there’s an answer, but you just can’t decipher how to fix the problem, even though the solution is staring you in the face. The struggle becomes even more frustrating! Your guides and instructions are a breath of fresh air. It’s nice to know someone cares and is willing to give of his time to help people. And all for free!!!
THANK YOU Stelion!!!!!
Please follow the instructions from this post and scan your computer with a bootable disk – http://malwaretips.com/blogs/how-to-use-kaspersky-rescue-disk/
Waiting for your reply to tell me how everything works out.
Ok, I think I may be in serious trouble:
– disabled firewall etc and still couldn’t access internet (same dhcp problem)
– downloaded combofix to another pc then tried copying to infected pc with memory stick but pc not recognising the stick (tried a couple)
– also noted some othe funny stuff like a message in bottom task bar (near clock) that says “the audio service is not running”
I have no idea what to try next :(
thank you stelian!your guide was very helpful!
Thank you!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Can you please update Malwarebytes and run a scan while in Normal mode?
Next,please run a new scan with HitmanPro
Last but no least:
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me if your laptop is ok ..
Hi
I did everything you said, step by step. It said that 13 viruses were found and deleted. It restarted my laptop in normal mode again and the virus was still there =( I tried again in safe mode. Did another full scan. 4 more viruses were found and removed and when I went back to normal mode. The nasty virus is still there!! Please help! I competed all the steps and can’t seem to get rid of it
Thanks in advance
Hello,
Please,run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
I was following your instructions to remove the Live Security Platinum from my notebook & when I got to part where I needed to restart in ‘safe mode’ by pressing f8 at the sound of the beep, I didn’t hear it & when I did press f8, windows seemed to start up in a ‘safe mode’ automatically and a screen popped up saying it was windows startup repair. i started the system restore it suggested, then panicked thinking it was a virus. I googled it and I’m not sure if it really is part of windows, or is a virus because several sites say it is a legitimate part of windows recovery security and several others say it is a virus. help me please? do i have more than just this live security platinum harming my notebook?
Beautiful :-) The easy-to-follow instructions killed the beast.
Thank you very much Stelian
On the same machine??
Ok, I got rid of Live Security Platinum. Thanks so much for the detailed instructions.
Now, by any chance do you know how to get rid of System Protector? I’ve got that too.
Thanks Stelian, you’re a good man and we do appreciate it!
Took it a step further and used Combofix as described. Still very slow to bring up internet.
Thank you so very much for this set of instructions. Saved me hundreds of $$.
My office computer was attacked yesterday by live security platinum after I click on the ‘close’ button on my expired Mcaffee pop up. I used another pc to google for help, and, luckily, I came across your site and followed your advice. It worked like magic! My pc is back to life. I can connect to the network, although I still can’t connect to the network printers (it keeps showing the printers are ‘offline’). Thanks a million, Stelian; you’re an angel.
Please ignor my problem with the Malware, I tried again and noticed the download was being blocked. I gave the ok and I’m running a scan now.
Hey Buddy,
Amazing step by step process on how to delete the virus.It’s 03.32 AM, i wanted to say a very big thank you to you before i go to bed. It took be a a few hours but i finally got rid of it by following your steps.
Thanks Again,
Agnel
Hello,
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
I’m having trouble with the fix and hope you can help. I downloaded the Registryfix and double clickked on the desktop icon, but I don’t know if it did anything or not, I got no messages saying it had done anything.
I downloaded Rkill and ran it, but the log says it found nothing.
I clicked on the malware link, which took me to a site called Malware bytes. I clicked on the download which took me to another site called TechSpot. I clicked on the download button there and nothing happened.
I have McAfee Total Protection and I don’t understand how this Live Security thing got through. I thought McAfee was supposed to be one of the best.
I am using McAfee firewall. After repeated attempts I was able to restore internet in normal mode only. Here is what I’ve done:
Malware Chameleon, went through all steps none seemed to work. All showed green.
Windows Registry fix – operated as described
Rkill – operated as described
Malwarebytes anti-malware – took a long time but seemed to work
Hitman Pro – operated as described
Eset – again took a long time, but seemed to work.
McAfee full virus scan.
It seems to be clean, but now on boot up the internet take 3 minutes to load. Is there any thing else I should try because I did all this in normal mode?
Excellent, this worked perfectly. This is the most thorough, exact and free malware removing solution I ever found on the internet. Thank you, it is very appreciated. You are not only competent but generous.
Hello,
Can you please run a scan with Combofix:
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Can you please disable your firewall to see if this will fix your internet connection.
Next,can you please run a scan with Combofix:
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
What firewall are you using?
Hello,
You most likely have a ZeroAccess rootkit infection on your computer.
Can you please run a scan with Combofix:
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Hi. I have the Live Security Platinum virus on my computer (Dell XPS Vista Ultimate). I have read your guide and most of the comments, but I don’t think I’ve seen an answer to my troubles. Please forgive me if you’ve already addressed my problems. I got up to Step 5. Malware did not prompt me for a trial period, but went straight to the Scanner Tab and the full scan. I clicked it, but it starts, and after 1 second working, the window disappears from my desktop!? The Malware process is gone! (I tried this twice and the same thing happened again.) I tried other things you recomended, although I don’t know if I was following them right, or if I needed to do other stuff first, for example I tried the Force Breach HitMan Pro. That actually seemed to work properly, and found a bunch of threats, but there was the reboot option, which I clicked, but the program just shut off. Perhaps I’m a bit impatient, but as nothing was happening, I clicked start, restart, and my computer restarted. When it did, though, there was a weird black screen that said HitMan Pro something something. I pressed enter (not knowing what else to do), and I think it started normally. When I logged on and searched for Live Security Platinum, it’s still there.
Any help with what I should do would be greatly appreciated. From reading the comments, you seem to really know your stuff and have helped many people (I hope to be one of them!). It seemed that they just needed to get the combo of programs in the right order. Please advise as to what to do; I will check back tomorrow.
Um, I think I have a problem. Prior to finding this excellent webpage, I’d gone to McAfee website for help. Downloaded “stinger” and “fixed” a few things. However my pc wasn’t fixed so i have now ended up at this site. I can only get as far as Step 1 (safe mode with networking, opened IE and uncheck the LAN setting .. which was already unchecked). However i couldn’t get an internet connection. Got a message about reconnecting DCHP? Hopped onto microsoft that to meto search for services.msc … Got a message that it doesn’t exist/isn’t installed. Can’t proceed to step 2 and now way beyond my computing limits. Help!
i was also infected, thanks for the help!
Dad managed to infected my PC protected with Mcafee with nasty Live Security Platinum virus. 24Hrs later it’s removed thanks to Stelian’s instructions. Dont be daunted – I am not a techy and I managed to do it with the instructions.
THANK YOU Stelian for this. God bless you and the family
Be patient and read the threads to avoid frustration. If your anti virus is Mcafee, check and ensure your Firewall can be turned on and off in settings. If you cannot manually adjust your firewall, use the Combofix app. All explained.
My download route in summary is RKill, then Malwarebytes, HitmanPro and Combo-fix after I could not turn on my Mcafee firewall. I would recommend using IE in the safe mode though your default browser might be another. Mine is Firefox but I found IE more user friendly. As advised dont kill any of the processes and I uninstalled my Mcafee instead of disabling. Combo-fix does give an incorrect message after uninstalling (Just double check to be sure).
Thanks once again for saving my money.
By the way, I cannot get to my windows fire wall settings or refresh my IP address due to “unknown error”… I’m on another computer to write this to you.
Wow, it seems like I’m going deeper and deeper. Here’s the rundown:
When I tried to install the HitmanPro, it showed blue screen saying that it shut down to prevented the damage. Kernal-Stack-Inpage-error. Technical Info. STOP: 0X00000077 (0XC0000015, 0XC0000015, 0X00000000, oXoF63D000)
Wehn I restarted my computer, I got the second blue screen stating the following. A process or thread crucial to system operation has unexpectedly exited or terminated. Technical Info. STOP: 0X000000F4 (0X00000003, 0X826942C0, 0X82694434, 0X805D22AA)
When I restarted, the HitmanPro did start but didn’t find anything. Here’s the strange thing. I was able to start in safemode with network so I thought I give your full instruction a try. I was able to go online but when I tried to go on your site, it directed me to a different site (Randomly) every time.
When I tried to go to your step 5, I was getting this following errer message “Runtime Error ’13’: type mismatch. I also got “The trial is not available for your product version. We apologize for inconvenience” and also ‘Program_error_updating (0.0. Host not found).
I found out that I lost the connection to the internet (Home network). I tried resetting the ethernet card, reinstalled/rejoined the network, reset the modem, WiFi and everything but I’m not able to get my connection to the network back. I’m not able to perform step 6 as the HitmanPro wants to see the internet connection first.
By the way, I had to scan with MalwareBytes without updating as I didn’t have connection but found 89 items and deleted them. Please help me…
Sorry, little more information, I am running Win XP SP3. I used the code given and have tried in safe mode and normal. Still unable to access internet.
I cannot access the internet on my infected PC. Check the Proxy. Still not able to connect. Help!
Hello John,
To solve this ,you can using Malwarebytes StartupLite or Msconfig,to remove that startup entry.
While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
Next,run a scan with Malwarebytes and ESET Online scanner.
Hello,
I have gone through the instructions and my computer seems to be working fine other then a Spler.dll error at start up. Iam running Win 7 64 bit. How can I make this error go away?
Hello, I have downloaded Malwarebytes Chameleon and tried to run it with the help file. The first one opened up a DOS screen and down loaded the file. When installing, I get Access Denied for a lot of files including rules.ref, config.conf, build.conf, custom.conf etc… I pressed rety and it does’t work. So I went ahead and installed it by pressing ignores for these files, I get “Failed to run MAM-Killer.exe”, “Failed to run Malwarebytes Anti-Malware” and ” Failed to disable protection driver”. Please help…
Hello Peter,
Lets work in Normal Mode:
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Please perform a scan with HitmanPro as seen on the guide.
3.Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
I am not getting the “Safe Mode with Networking” when I press F8. When booting up, my computer only displays options for F2 and F10. I have an old Dell. Please help.
HitmanPro and Malwrebytes are only on-demand scanners (basically they are just cleaning tools which won’t protect your system).You can uninstall them or let them on your system and regularly perform system scan to check if everything is ok. :)
Good Luck!
Wow I didn’t believe I was going to be able to do it!!!! But your detailed instructions made it work like a breeze. I know nothing about computers and I was about to call a computer specialist…But I carefully read your steps and chose to try…
Just a couple of questions: Should I keep Malwarebytes and Hitman both in my computer? Are they compatible? They cannot work as an antivirus, as far as I know… Or am I wrong? So a combination of antivirus plus Hitman plus Malwarebytes…would it be ok?
Viva La Barca! Thank you so much for the fix! Up an running again.
Thanks a lot for that. Really useful.
I was so sceptical of this process at first and thought i should just take it in to the shop and pay for them to do it. I am not good on computers and have never tried to fix any virus myself! but your incredibly detailed and directional guide made it easy for me to do and now my computer is clear! Thanks so much for the guide, it really helped me out and i will suggest this website to other with computer problems.
Hello Amanda,
You most likely have a ZeroAccess rootkit infection on your computer.
Can you please run a scan with Combofix:
STEP 1 : Run a scan with Combofix
Download ComboFix from one of the following locations:
COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
COMBOFIX DOWNLOAD LINK #2 (This link will automatically download Combofix on your computer)
VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
———————————————————–
———————————————————–
———————————————————–
Notes:
STEP 2: Run a scan with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Okay, so I followed all your steps and it seems to have cleared my computer of everything but a desktop.ini virus and a win64 virus. I have run all over the internet trying to figure out how to fix those and nothing seems to have helped. Do you have any added advice? Any ideas of what I can do?
Not sure if I can post pictures, but if I can here is a picture of the scan results:
http://tinypic.com/r/15rlfkz/6
Thank you for this guide, it was great.
After I have completed everything I still get a .dll error. It is asking for spler.dll. What can I do to stop this error?
Thanks,
Hello,
Please uninstall McAfee then run a scan with Combofix :
Can you please run a scan with Combofix:
Download ComboFix from one of these locations:
Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
Link 1
Link 2
* IMPORTANT !!! Save ComboFix to your Desktop
See HERE for help
**Please note: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, ComboFix will produce a log.
Note:
1. Do not mouseclick combofix’s window while it’s running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
After this step has been completed , you can reinstall McAfee.
Then report back if your issue is fixed or not!
Thanks for you help.
Mwahahahaaaa! ComboFix did the trick. It replaced the file with an original, and removed those two viruses, plus two more. I ran another scan of HitmanPro, and it found no threats. My internet speed is back to normal, as well.
Thank you so much, Stelian. You really know your shi_. -Josh
Thanks alot! The procedure worked perfectly for me.
Very helpful and easy to follow. Needed to update malware database prior to scan to complete removal. You should consider adding button for people to make small donation to maintain your solution.
I have went through all the steps and have control over my computer again. However I cannot get my mcafee’s firewall to activate and when I run a mcafee’s scan it is coming up with 2 trojans that it says it cannot delete. I am now running Kaspersky that I saw in one of your replies but figured I would go ahead and post in the meantime in case you knew of a solution to my Mcafee’s issue.
Hello,
Check your startup items with Malwarebytes StartupLite to remove any unnacesary files from starting with Windows.
Next,please defragment your computer – http://windows.microsoft.com/en-us/windows7/improve-performance-by-defragmenting-your-hard-disk
Also please run a scan with ESET Online Scanner,just to make sure you don’t have any left over infections.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
If it is still slow than you’ll need to run a File System Check and Disk Check… To do this , download Windows Repair All In One and install this utility.
Then go to Step 2 (Check File System) and click on “DO IT”, after this step is done, go to Step 3 (System File Check) and again click on DO IT.
NEXT,go to the last Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
Note: Leave everything else unchecked
Hello,
Please download and run the registry fix from the guide.Alternatively you can use the license key from the guide and stop this behavior.
Hello Sara,
Did you run a scan with HitmanPro?
Also please update Malwarebytes and run another scan.
Next,please follow the below steps:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Hello Josh,
It seems like you have a ZerroAccess rootkit on your computer……
Can you please run Combofix:
Download ComboFix from one of these locations:
Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop
Link 1
Link 2
* IMPORTANT !!! Save ComboFix to your Desktop
See HERE for help
**Please note: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, ComboFix will produce a log.
Note:
1. Do not mouseclick combofix’s window while it’s running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Waiting for your reply to tell me how things are running.
Hello,
Yes,you can delete and uninstall all the tools used in this guide. Stay safe!
Hello Grace,
Please run a scan with Malwarebytes Anti-Malware in Chameleon Mode in Norman mode:
2.Next,please perform a scan with HitmanPro as seen on the guide.
Thank you very much!!!! your step by step guide worked and now my laptop is ok. Thanks thanks thanks!!!!!
Hi Stelian,
I have tried to follow the process. However, right after being in the safe mode, my keyboard was locked and I’m not able to write anything….I’ve checked many things (unplug, plug the cable,…..made sure everything is unchecked in the configuration,….used another keyboard…). Do you have any suggestions on how I can fix this problem to be able to continue and remove the Live Security Platinum.
Many thanks for your help!
Thank you so very much! Your guide saved my computer, and my money. I thought I was going to have to take it in, or kill it. Then I found your website and everything went by in ease. I have full control over my computer (or so I believe) but find the Live Security Platinum “video” I downloaded unaware it wasn’t what was labeled, is still listed in my notifications (though it’s not active). Is this dangerous? If so, how can I remove it? Malwarebytes says there were no malicious malware detected on the second scan which took place after the reboot in normal mode.
Also, I was wondering if it could spread to any other computers on my network if they were accessing the network at the time of my computers infection and uninstallation process? I was unaware this was so until today.
Sorry to take up your time, but it is much appreciated. Do you maybe have the answer to my questions?
I’ll check back often.
-Sara
Stelian,
thanks for this thorough solution for removing LPS malware. Like others, my PC got infected after performing a Java update. Your instructions helped to remove the infection, but more importantly, to understand how it operates. This will help me respond more intelligently the next time my system is infected (and there will undoubtedly be a next time.)
The last time my system was infected by something very like this, my IT organization made me rebuild my disk from scratch after disinfecting my data files. It cost me a week of lost productivity and the loss of some software because I no longer had license keys for some video editing apps. Your solution saved time and those licenses.
Thanks again!
Hi,
Thanks so much for your tips on how to get rid of the trojan. As i’m only 12 it has been a good experience of how to get rid of viruses. Me and my family can finaly do work and I can get back on Skype and Minecraft.
Thanks again,
Simeon Elliott
What a great help! Thank you!
I have just one question,
Can I delete the “mbam-setup-1.62.0.1300” and the ‘registryfix’ files ?
Or it gonna have to stay in my Computer ?
Thanks a lot !
Hey, Stelian.
Thanks for your guide. I’ve been following the instructions, and I’ve been making great progress.. until the part with HitmanPro. I’m bothered by something:
I’ve scanned using HitmanPro three times. The first time I scanned and removed, I found about 7 Trojans/Malware, and when I was prompted to restart, my computer blue-screened/crashed. The second time I scanned, I only found two Trojans. I removed, and didn’t blue-screen when I followed the restart prompt. The third time I scanned, I found the same two Trojans.
Every time I’ve scanned, these two Trojans have been present. One is named services.exe, found in C:\Windows\system32. HitmanPro states it must replace this file with the original version to maintain stability. However, every time I’ve done the removal process, at the end, it says “Delete Failed”, and the Trojan maintains its presence on my machine.
The other Trojan is named Desktop.ini, found in C:\Windows\assembly\GAC_32\. Every time I’ve done the removal process, at the end, it says “Delete on reboot”, yet every reboot, it comes back the next time I scan.
This bothers me. I could really use your help on this one.
Please and thank you! -Josh
Thank you very very much :) you are the best!!! you saved my pc at work! i have soooo much stuff in it. THANK YOU THANK YOU ……you are the man :)
Somehow, thank you just does not seem to be enough. I am humbled by your kindness
Thank you Mr. Pilici, it worked.
I’m puzzled that the Live Security Platinum virus was able to change the registry entry in [HKEY_CLASSES_ROOT\exefile\shell\open\command] and the other HKCR entries to disable running .EXE files.
I use my Win XP SP3 system as a normal user without Admin privileges. Would you have an idea how the virus got access to the Registry?
I ran a system restore and things are now working but it is a tad slow. Is there anything I need to do now? Thanks!
Thanks for this guide Stelian! Unfortunately after running everything, when I’m in normal mode, nothing will open. I’ve run everything in Safe Mode and removed everything the various programs gave me, but nothing works in Normal Mode. I mainly cannot access any of my internet platforms (Firefox, Chrome or IE). Is there something else I can try? Also when my computer starts in Normal Mode it says that MalWare Bytes cannot run the cleanup file. Help please? Thank you!
Yes,you can use the above tools as they are only on-demand scanners (basically they are just cleaning tools which won’t protect your system)
Good Luck!
If I overlooked the answer to this in the guide I apologize.
Can I use this guide (downloads included) if my computer is currently running Microsoft Security Essentials? Will it conflict with any of the programs you suggest in the removal guide?
Thanks – I seem to be all sorted. I am officially a FC Barcelona fanatic!. Top man, keep up the good work.
Chris
thanks a lot, your simple way rescued my notebook.
thank you, thank you, thank you. really good instructions, easy to follow, and saved me big time. Appreciate your good work.
Thanks for the guide. It really help a lot.
Thank you very much!!! It was of great help…
Did you check for any proxy server (see step 2 on the guide)?
Can you try to disable your antivirus and firewall while doing the ESET scan and see if this will fix the problem…
Your generosity in providing this information and providing your time is amazing. See, there are some “good guys” still around.
I went through the steps successfully. Found it interesting that every scan, the last one being eset, found virus’
A heart felt thank you.
Flash
Excellent. Keep doing what you do which is being one of the good guys.
Thanks for the help, the computer starting running normally again on normal mode without me using combofix. However, if the computer starts acting up again I will use it and get back to you. Thanks again for the help.
Thank you SO much for your easy instructions! You are totally awesome! Sending you many blessings!!!
Hey Stelian,progress has been made,my pc is on normal mode now without any sight of Live Security Platinum.However, the ESET scanner could not be updated and states “cannot get update.Is proxy configured?”,any solutions to this? Thanks !
Thanks – really clear tips and no pushing products. Great advice!
Hello,
Lets try do this another way.Please follow the below steps while your computer is in Normal Mode:
1.Run a scan with Malwarebytes Anti-Malware in Chameleon Mode:
2.Next,please perform a scan with HitmanPro as seen on the guide.
3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Hey Stelian,thanks a lot for creating this guide. But my Malwarebytes’ Anti-Malware did not manage to complete its full scan (I’ve tried four times and usually the scan only runs 20 minutes+) and my laptop shuts itself off. And also when I’m running IExplore/RKill it does not terminate any processes. Any input from you(or any other user) would be greatly appreciated.Thanks a lot!
Lets try one more thing and than if it doesn’t work, your can reset your computer.
Please follow this guide and run a scan with Combofix.
Let me know if that fixed the problem or not.
Thanks a bunch for your help! The Live Platinum Security virus would not allow me to connect to the internet at all, even after trying all the internet connection tips. I finally resorted to using the fake registration code, and that allowed me to gain access to the internet once again. I am now running all the software to get rid of the virus for good! Thanks again!
THAX n GBU
Thank you Thank you, Stelian! Will go read the articles now!
Thanks! It worked :)
Thank you very much for your helpful information in removing this virus.I am really greatful to you. Best wishes for you.
Thank for the help, but the computer is still very slow and unresponsive, to the point where it says Windows is not responding. What should I do? Should I factory restart my laptop?
Thanks so much!!!!
Hello Joe,
Yes,I think that if you reinstall Windows on Pararels you should be fine..This type of products work like a sandbox so basically if you do a reinstall you should be ok!
Something that your wife needs to read: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. Stay safe!:D
Hello,
Lets try to fix this and have a new FC Barcelona fan:D
First run a scan with RogueKiller:
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
Next,you’ll need to run a File System Check and Disk Check… To do this , download Windows Repair All In One and install this utility.
Then go to Step 2 (Check File System) and click on “DO IT”, after this step is done, go to Step 3 (System File Check) and again click on DO IT.
NEXT,go to the last Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
Note: Leave everything else unchecked
Let me know everything goes…:D
I share an iMac (OSX 10.6.8) with my wife. We installed Parallels 7 desktop to run Windows 7 on the Mac so she could access a work related site that requires a PC. The other day she was checking e-mail on the Mac side (aol.com) and found an official looking e-mail from USPS saying that a package she was supposed to have sent was undeliverable. She never sent such a package. She clicked a link to get more info about the package, and it downloaded Live Security Platinum. Not knowing what that was she tried to open it, and it opened Windows and displayed the Live Security Platinum Warnings and error messages. The correct thing to do would have been to send the USPS e-mail to Spam.
Since my wife only uses Windows 7 to get on one web site , and she has no other data files saved on the PC side, is it possible to re-install Parallels, Windows and Explorer to remove the Live Security Platinum? What do you think?
Thanks,
Joe
Yeah!! The solution worked great..!! Thanks for the help!!
Don’t even realize when was the virus get into my pc..
Hello,
I ran both scans and they both found nothing :).
Thank you very much for your help!
Steven
I have no idea why you can’t turn your McAfee Firewall on,however a re-install should fix this.However I do advise you to remove McAfee and install another security product because McAfee is not that great..
Quick tips;
Free – Avast 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012 or Avast Internet Security 7
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
Thank you so much!! You are my savior :)
Further help please!
Firstly as with all the comments, thanks for you advice. Top man.
I have cleared the Live Security Platinum malware using your initial steps, followed by both Kaspersky Virus Removal Tool and then ESET Online Scanner utility. Like one of the other threads everything is working fine but my windows firewall is corrupted as is my windows update. I get the error message “update your firewall settings” then when I click on “use recommended settings” I get the error message “windows cannot change some of your settings. Error code 0x8007042c”. On the Windows update page this was also corrupted. Following your advice I installed and ran through all the steps of tweaking.com – windows repair (all in one) but the Firewall error perists. The windows update now allows checking for updates but throws an error when I try to download and install new updates. Please help. It would be a great shame after clearing things so well to have to re-install the operating system (Win 7 profession 64-bit). Fix this am I become a Barcelona fan!
Thanks for the effort. Your instruction helps me by fixed my problems. Thanks!
Thank you Thank you, Stelian!!!
I successfully removed Live Security Platinum, however the Firewall on my McAfee Security Center is off. I can’t turn it on anymore, every time I turned it on, it went off again. Is it because of the Hitman Pro or Malwarebytes’ Anti-Malware? Thank you for your heavenly help again!
Hello,
Lets try do this another way.Please follow the below steps…
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes and then do a RogueKiller and Unhide.exe scan as seen on the guide
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Hello,
Please do a ESET Online Scan,and next do a scan with RogueKiller as seen below:
ROGUEKILLER DOWNLOAD LINK (This link will automatically download RogueKiller on your computer)
If you are still experiencing problems while trying to remove this rogue from your machine, please start a new thread in our Malware Removal Assistance forum.
Good luck!
Ok,now I understand..You see that Java sign in Windows…Because you have Java installed… :)….
Go to Add or Remove Programs and uninstall Java…and you’re done – http://www.java.com/en/download/uninstall.jsp
Stay safe!
Yes,Remove Temp Files….made a typo :)….
No you’re fine to just continue.. just rerun the Malaware Bytes software again, it’s because you chose incorrectly during the installation, but no worries all is good.
Thank you for all the time and effort in putting this together. I have followed the instructions after having this physically show up on my Start menu and pop up when browsing starting two days ago (who knows how long it’s been around). We have 4 users on our home computer and my daughter used hers before we notified her not to, it just showed up today in her user account.
I didn’t need to use the registration code, although a few things popped up initially the other day…I was able to start in Safe Mode, LAN wasn’t checked, used Registryfix, Rkill, and Malwarebytes (already on my computer but had to update) with moderate success. Live Security Platinum still showed up in my start menu so I ran Kaspersky checking the five boxes you listed for others (including my huge removable drive). Finally, LSP is wiped out of my start menu but I still have three flashing suspicious icons (7966335.exe-two of these same item and Java Auto Updater) “is requesting permission to…” The Java program is one that had corrupted files/virus. I plan on running the Eset Online Scanner next unless you have another suggestion.
Thanks, but the Java thing is not on the Firefox toolbar; it’s on the Windows toolbar (though perhaps it’s not called a toolbar). Maybe it’s perfectly innocuous and I’m being unnecessarily suspicious. I did take your advice and reset Firefox to its default settings, though. Certainly can’t hurt.
I’m going to use the windows repair right now, but I don’t see “Repair Temp Files” I only see “Remove Temp Files” is that the option I’m suppose to chose?
just tried it on mine and got the same error. however, i just clicked ok and it still ran fine while in safe mode. hope this helps
I ended up going back to safe mode and using HitManPro. It found A LOT of items and removed them. I then used malwarebytes Anti-malware and it found 21 more. Went back to HitMan, it found more and then back to malwarebytes, it didn’t find any, went back to Hitman, it didn’t find any….I can now use my computer!! Thanks so much!! there are free advice places that have a section where you can donate to help out you wonderful people. Do you have one???
Hello
When I went to add the rkill it gives me a message that says the iexplore.exe has stopped working and the only option is “close program”. I have tried downloading other versions of the rkill but they continue to give me that same message. I left it be while typing this and in the notepad that pops up it said that it terminated the process downloads\explorer.exe is that what is suppose to happen to continue on to the next step with the malwarebytes?
Thanks sooo much for your help and the money you just saved me. Do you know of any good, FREE anti-virus software I can install until im able to but the Norton i seen advertised recently?
I got that message too. Then the program updated and i was able to continue.
Hello,
Just reset Firefox to its default settings: http://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems and everything should be ok.
I ran the ESET scan, and it deleted eight threats, all connected with Netscape Navigator (which is installed on my computer, though I haven’t used it in a long time). Still don’t know how to get rid of this Java thing on my toolbar. Thanks, again, for all your help.
Yes,you can try to run a scan in Normal mode,if it doesn’t work than reply and I’ll help you. :)
Good luck!
I got to the point of installing Malwarebytes a Anti-Malware and right after clicking finish, I got an error message staying I couldn’t run the program in SAFE MODE. At this point, is it safe for me to reboot in normal mode to continue the removal process?
As a quick answer :
Free – Avast 7 Free version or COMODO Internet Security
Paid : Norton Internet Security 2012 or Avast Internet Security 7
Anyway ,you should really start a thread in our Security Configuration forum as you need to build a layerd security config: http://malwaretips.com/Forum-Security-Configuration-Wizard
Also it would very good if you took the time and read this article that I’ve wrote: http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/ .. If you follow it,then we’ll never meet again in this conditions:)
thanks for the respond, the think is that when i delete the virus, i did it manually by right click the delete botton and then empty the trash; i check this page afterwards, and i am worry that what i did was not enough, still i dont see any problems any more; what i want to know if the only thing i still need to do is to make more scans with other softwares, or if there is the certainty that there is nothing else around, and that my deleting it manually is not enough, i delete a carpet with three archives, and then i delete all the icons; i will make more scans anyway, but i would like to know what else can the virus do, beacause i have access to internet, and i can click on executables now, is there any other treat that virus do? or if it is possible that it reinsurrect again some how?
…btw..my computer is a little slower but there is no redirecting or messages from live security platinum…so unless theres something else i could do to get my internet back to speed im a-ok!!!
ok. just finished an eset scan.
Scan Log
Version of virus signature database: 7309 (20120718)
Date: 7/18/2012 Time: 9:04:08 AM
Scanned disks, folders and files: Operating memory;C:\Boot sector;C:\
Operating memory » C:\Program Files\UltraVNC\WinVNC.exe » ZIP » – archive damaged
googledesktopsetup.exe » PECompact v2.xx – is OK
C:\WINDOWS\Temp\avg-4d0cf54e-7a81-4f59-8160-c52061d3f159.tmp » INNO » – archive damaged
Number of scanned objects: 584806
Number of threats found: 0
Time of completion: 10:17:52 AM Total scanning time: 4424 sec (01:13:44)
Notes:
[4] Object cannot be opened. It may be in use by another application or operating system.
‘no objects found’!!! THANK YOU!!! you are a lifesaver…i will definitely look you up if i ever run into another virus :) you’re amazing Stelian ;D
Thank you very much for putting this together. It was easy to follow and appears to have worked well. Going forward, will the Malwarebytes Anti-Malware be enough to protect my computer? What’s the recommended method to prevent something similar going forward?
-Nat
Hello Mark,
You can perform a scan with the following utilities for your peace of mind:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Stay safe!
Thanks for the help and advice.
-started in safe mode removing the Live Security Platinum references from registry per another’s suggestions
-came back with malwarebytes scanned and removed some more
-next reboot found malwarbytes was picking up some items still
-used Rkill I believe from the links above and returned nothing
-Hitman Pro was a life saver…however, it took two attempts and a “force to delete instead of quarantine” to take.
-thought I was complete…decided to run ESET scanner and now have found 2 infected files variant of Win32/Injector.TYT trojan JS/Redirector.NIQ trojan”…which makes sense as while testing I had just clicked on a few google search results pages that bounced me to some obviously incorrect pages.
I likely missed a step or followed the instructions from multiple sources that overlapped with yours, but I’m worried every time I add a new scanner I find new stuff. Regardless, thank you and I’ll keep following the thread for any new advice. Good luck everyone and keep at it.
Yes,it should be gone.How is your computer behaving?Are you seeing any other alerts from Live Security Platinum?
Also download, save and run the ESET ‘Win32/Sirefef’ stand-alone malware removal tool and follow the prompts as directed to check for any sirefef ifnection.
ESET Sirefef Remover Download Link
ok. so malwarebytes doesnt come up with anything but everytime i run an eset scan this is what pops up and i manually delete it every time:
Operating memory » \GLOBAL??\2b090f37\WINDOWS\$NtUninstallKB9278$\722014007\Desktop.ini a variant of Win32/Sirefef.EZ trojan
how to get rid of this for good? live security platinum isnt listed in the programs in the control panel so can i assume it isnt on the computer anymore?
11 minutes into the scan and no objects detected!!! hopefully it stays that way :) thanks for all your help…ill let you know how it turns out…you are AMAZING!!! and your help is priceless :) THANK YOU!!!!
MajorGeeks is a good site which is hosting a Malwarebytes download mirror…so it’s ok to download from them :)
Here is the direct download link for Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam-download-exe.php
Good…now i have a new problem. I went to download malwarebytes and it hit download now on the free version. it took me to a site called majorgeeks.com and tried to have me do a scan….I went back to the link you provided got to the malwarebytes page, hit the left ctrl key and hit download now. the majorgeeks site opened in a new tab. am i supposed to go through majorgeeks? or is this just the virus redirecting me?
THANK YOU! THANK YOU! THANK YOU!You are the best!! You saved me 100$…. ***** you geek Squad!
Thank you MalwareTips.coM!
Yes,ESET and Malwarebytes should remove this infection without any problems…Just to the scans and then report back.
You can try to uninstall and then re-install back Firefox.
As far as the slow down did you check your startup items?If no,then you can use Malwarebytes StartupLite to remove any unnacesary files from starting with Windows.
Next,please defragment your computer – http://windows.microsoft.com/en-us/windows7/improve-performance-by-defragmenting-your-hard-disk
Also please run a scan with ESET Online Scanner,just to make sure you don’t have any left over infections.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
If it is still slow than you’ll need to run a File System Check and Disk Check… To do this , download Windows Repair All In One and install this utility.
Then go to Step 2 (Check File System) and click on “DO IT”, after this step is done, go to Step 3 (System File Check) and again click on DO IT.
NEXT,go to the last Startup Repairs tab and click the Start button (bottom right)
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
Note: Leave everything else unchecked
well this is a work computer…could that be the problem? is there a way to remove the malware without using hitman pro or using a different program? i have eset antivirus and eset sysinspector on this computer already…will either of those do the job?
Hello, I followed all the steps and it worked great! However, since I got the virus off my laptop Firefox takes forever to respond and the computer seems slow any suggestion?
If this is your personal computer then it’s not normal….HitmanPro is free to use for scanning and removal for home users…..
This is an activation code for Live Security Platinum: AA39754E-715219CE , this will NOT remove this rogue software,however it should stop those annoying alerts.
Now,can you please run the HitmanPro Force Breach Mode again just stop the malicious process.
Next, please start a scan with Malwarebyte Anti-Malware as seen on the guide and remove any detected infections.
Next,run a ESET Online scan (you have the instructions in my previous reply) to remove any other malicious files.
Then please re-scan with HitmanPro and if it will find any malicious files then write the path and then we will manually remove them.
Ok. I got HitmanPro to run, but at the end of the scan, there was no ‘activate free license’ option. …is that normal?
Phenomenal. Thanks.
Hello Dank,
Did you run a scan with Malwarebytes and HitmanPro?
As a additional step ,you can perform a check with ESET Online Scanner:
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Stay safe!
hello, here is my story, i was checking a blog, and then suddenly the virus installed on the computer, sending his messages constantly, and not letting me open any executable files, not even the notepad; since i coulnt log on the internet to check your advice, i was very desesperate and i didnt know what to do; then suddenly out of curiosity, i decided to restart the computer in secure mode, then i feel relaxed again beacause the messages stopped and it let me open other executables; so what i did afterwards was to right click the icon of the virus on the desktop, and when i found the adress, i went to the carpet and delete it, and then i throw the trash, after that i delete the icon of the desktop; then i restart the computer in normal mode, and run the mcafee to make a complete revision of the computer, and it didnt found anything. My question is, is the problem really solved? or do i need to check something else?
This is an activation code for Live Security Platinum: AA39754E-715219CE , this will NOT remove this rogue software,however it should stop those annoying alerts until you will use the removal tools.Does your internet connection work now?
Also you can download Malwarebytes and perform a scan now?
Hello Michelle,
Yes, try another RKILL version… If it doesn’t kill the process in 10 minutes then it’s most likely stuck.
If it still doesn’t work,please try the below steps:
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Hello,
Hello,
Lets try do this another way.Please follow the below steps:
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Thank you!!! These steps worked great for removing the virus from my computer, and using the License Key to stop the fake alerts was very satisfying for some reason.
Thank you for taking the time to post this! It worked out great and I really appreciate your instructions. Go FC Barcelona
How long should it take for RKILL to scan and create a log? I have been waiting about 10 minutes, every once in a while I see an hourglass by the pointer.
Should I try another RKILL?
Stelian,
I tried to use your advice to remove the platinum malware virus but I cannot even access the I tenet on my computer anymore so I can go all the way to step 6 where it tries to access the Internet and I can’t go any further to finish the process, please help, my IT department can’t figure it out either!!??
Any help would be appreciated??!!
Heather
Hi :) i have this virus and every time i try to install RKill or one of its renamed counterparts i get an error field stating that the installation failed because ‘it was already being used in another process’..could it be because i think this computer is infected with live security platinum as well as security shield? (at the same time!)…please help!!
Thanks. The printer icon is the only thing I use on the toolbar (if that’s even what you call it). I don’t know how to get rid of the other stuff and have never felt particularly motivated to find out. I am using Firefox. I just started the ESET scan; I imagine it will take a long time, as Kapersky took all night.
What browser are you using and why on earth do you need a toolbar?:)
Please run a ESET scan as seen on my previous reply.
Hello Lauren,
You can also run an ESET scan if you have the time:
Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Based on that report, I am now concerned about the Java icon that appeared on my toolbar at some point during the virus attack and keeps saying it needs to be updated. How do I get rid of this?
Thanks again, Stelian.
Kaspersky did catch something the others did not. Here’s the report:
: Deleted (events: 1)
7/16/2012 9:20:17 PM Deleted Trojan program Trojan.Win32.Inject.eift C:\Documents and Settings\Lauren\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\25877b37-15c52381 High
Worked great! Thanks for your help!
Thanks for this!! Actually, I was fixing this on a remote machine and couldn’t start any programs or boot into safe mode (because I was remote). Putting in the activation code allowed me to run the regedit fix and delete the virus all without safe mode, am currently scanning to remove anything else.
It’s really a wonderful easy step by step removal of harmful marlware. I was shocked to see that my computer was affected. After reading your article, I got the confidence to do it myself and followed your 6 steps and everything went fine. Now my computer is without any malware. I really thank you for this wonderful article.
I love you Mr. Stelian Pilici!
Hello,
Lets try do this another way.Please follow the below steps:
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
Hello Debbie,
This cyber criminals are usually from China,Russia or another eastern European countries,and at some point they get caught however it takes along time for this to happen because different organizations across the globe from need to work together.As you imagine this process is not very quick and all the investigations take some time so from here comes the need for a International cyber crime police divison.
Another problem is that users aren’t even aware that they have been the victim of cyber criminals and they don’t report it.
Here is some very interesting video which you can watch:
http://www.youtube.com/watch?v=cf3zxHuSM2Y
http://www.youtube.com/watch?v=WQgeUHlTThc
Just today,there are reports that 3 cyber criminals where convicted to 8 years of prison for install keyloggers on some computers: http://nakedsecurity.sophos.com/2012/07/16/seattle-cybercrime-trio-sentenced-for-3m-hacking-spree-via-wifi-and-malware/
Stelian
Thank you. Thank you. Thank you. Everything worked perfectly. My computer actually feels like it is running faster now!!
Sanjay
Hello Stelian:
I posted earlier thanking you – but now have a question. How do these people
continue on the web collecting unsuspecting users credit card information and using it without eventually getting caught? You would think that the credit card police would be able to track them down. Do you have any insight into this? – Thanks (more just wanting to vent my frustration – not only about going through the fix – which you made easy – but going through the initial panic when your computer/programs/data won’t run)
You ROCK!!!! All of the virus seems to be gone from my computer – I had this or a similar virus approximately 1 year ago and we wound up cleaning off the hard drive and starting over. Thank you, thank you, thank you.
Stelian, you are a saint! I initially thought this virus had totalled my computer (since nothing would open), but thanks to you and your six easy steps, everything seems to be back to normal. I am running the Kaspersky scan just to be extra-sure, but all seems to be going well. Thanks so much!
Thanks so much! The instructions were amazing for someone who is not at all computer savvy. I was able to delete the malware myself and am very grateful.
Lavinia
I am trying to remove the virus for the 2nd time– thought I had it last night ( followed instructions) only to find it was in place when I started the computer this morning.
I don’t remember getting a “re-start” message after the latest scan with malwarebytes.. but apparrently 7 files were removed
Now the computer seems to be hung up at removing a trojan — while on the 2nd sweep, with Hitman
also for your info.. there was no Proxy checked on the LAN settings
any suggestions?
Thanks a lot for this step by step guide. Really helpful!
Dear Stelian
Thanks this virus/trojan got into my computer too. Could still use the internet but antivirus and makware remover wouldnt work, and couldnt remove the pirate program either
The people doing these things are malicious arent they?
Managed without too much effort by following yr instructions…..
You laid it out very simply, you should also do something paid….. for sale, great style, that you have.
However my 75 yo Mum would be challenged, probably to follow this if she had to, probably why my brother set her up with linux LOL
Thanks again very very very much !
Hello Steven,
If you want to perform another check,then I recommend that you do a scan with the following tools:
1.Run a scan with Kaspersky Virus Removal Tool
Click here to download the Kaspersky Virus Removal Tool.
2.Run a scan with Eset Online Scanner.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Stay safe!
Hello,
I went through all the steps as instructed. Is there any way for me to check if all malware is gone? Also i had some files on my computer that i sent via e-mail after it was infected (didn’t want to lose them) is there any chance they are infected? As you can see i’m not very knowledgable about this stuff :). Any help is appreciated.
Steven
Thank you very much, this has been highly helpful. God bless you :)
thank you for the sharing.
Great article…helped me save a lot of time.
Thanks,
Ram
Thank you very much for your easy guide in removing the Life Security Platinum virus…was able to do it just by following it step by step. God bless you.
Hello,
Please follow this steps:
Download Windows Repair by Tweaking.com to your desktop. Use the direct download link for the Portable version of Windows Repair by Tweaking.com
Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.
Note: Leave everything else unchecked
I’m having a problem with my Windows Firewall. I followed the directions to get rid of the virus, and it looks like it’s gone. I double checked with a scan from ESET and again with HitmanPro to make sure and nothing came up. I’ve tried to reactivate the firewall manually but I keep getting the error code 0x80070424. I looked it up on the Microsoft site and it said I might have malware. Again, I scanned with HitmanPro and nothing came up. I tried a recommended solution telling me to update, but Windows Updater won’t work either. It says the service is not running. So I restarted like it said, and tried again, but the same message is appearing. Any suggestions?
Thanks for all the help bro. Very helpful step by step guide. If I ever have another problem I’m just going to visit here instead of calling my useless security provider that il paying yearly for who suppose to prevent this stuff from happening in the first place. Lol
Hello,
I’ll report this problem to the HitmanPro developers.please run a scan with ESET Online Scanner and then re-install HitmanPro and try again to do a scan scan.If there are stil malicious files found ,write the path down and we will remove them manually.
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
If you are still experiencing problems , start a thread in our Malware Removal Support forum : http://malwaretips.com/Forum-Malware-Removal-Assistance
The Security Shield rogue has been around for a long time….here is the removal guide: http://malwaretips.com/blogs/security-shield-2012-removal-instructions/
Stay safe!
Hi I was able to remove this virus using.both programs. Now I have a new virus. It’s called security shield. It looks exactly like live security platinum. How do I remove this and why didn’t those previsoly installed programs prevent this. Lol. Same proccess? You should make a post about this
Thank you for sharing.
I just got hit with this darn thing today and figured I would Google it, not thinking I would find something that would be as descriptive and helpful.
Thank you
I followed all of your instructions and everything worked until after I ran HitmanPro. When I ran it, 17 threats were found but when I tried to remove them, I didn’t get the link to activate the free 30 day trial. I am unable to run the program without paying for it. Am I doing something wrong?
Nods to Stelian, it looks daunting on the page, but it worked like a breeze
Thanks buddy;)
Thank you so much for these “easy to follow” instructions on how to remove this fake program! I was terrified when I booted my computer and was unable to remove it the normal way…you SAVED my computer!!
Hello,
Lets try do this another way.Please follow the below steps…
STEP 1. While in NORMAL MODE,download HitmanPro and then start this program in ForceBreach Mode
1.Here are the direct download links for HitmanPro,
– http://dl.surfright.nl/HitmanPro36.exe (For 32bit)
– http://dl.surfright.nl/HitmanPro36_x64.exe (For 64bit)
2.Hold down the left CTRL-key when you start HitmanPro and all non-essential processes are terminated, including this rogue malicious process
Here is a video that explains with graphic details how to do this : http://www.youtube.com/watch?v=m6eRWTv2STk
3. Let HitmanPro scan and remove the detected infections.
STEP 2: While in NORMAL MODE,download/Run Rkill and then run a scan with Malwarebytes
1.Download any re-named version of Rkill (direct download links bellow):
RKILL DOWNLOAD LINK #1
RKILL DOWNLOAD LINK #2
RKILL DOWNLOAD LINK #3
2.Next,please perform a scan with Malwarebytes as seen on the guide.
STEP 3. Run a scan with ESET Online Scanner
ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
Waiting for your reply to tell me how everything is working.. :) Good luck!
I somehow got his lovely virus and when I try to open windows with safe mode and networking I get the error message ” the program can’t start because SHELL32.dll iis missimg from your computer. Try reinstalling the program to fix this problem” and then it just says safe mode and nothing else a black background help me please!!!
Yes,you still need an antivirus because the tools from this guide are only used for scanning.
However I would like to suggest that you change your antivirus from Microsoft Security Essentials to Avast 7 Antivirus FREE as it’s a way better option :)
Stay safe!
Thanks for the assistance.
I had MS Security Essentials and it is no longer running. Do I still need it with these other programs?
Hello Kevin,
Here is how you can create your own registryfix.reg :
1.Create and run your registryfix.reg
A.Copy all the text in bold below and paste to Notepad/Text Document
B.THIS IS VERY IMPORTANT! Save file as fix.reg to your Desktop. NOTE: (Save as type: All files)
C. Double-click on fix.reg file to run it. Click “Yes” for Registry Editor prompt window. Then click OK.
NEXT,follow the guide to remove the malicious file from your computer.
Good luck!
Thanks, worked perfectly!
hi. i cant get past step 3. when i try to dowload the registryfix.reg file it says my security settings wont let me download the file. What should i do?