Jun 5, 2010

Remove Sysinternals Antivirus - Sysinternals Antivirus Removal Information

Sysinternals Antivirus is a ransomeware that will surprisingly appear on your PC and will have a great impact on your computer’s effectiveness. Sysinternals Antivirus is the part of the family of rogues which includes such malicious applications as Your PC Protector and XJR Antivirus. All of the programs listed above are certainly the applications you need to stay away from. Sysinternals Antivirus is expanded with the help of nasty Trojan which is the matter why you can’t detect the invasion process of Sysinternals Antivirus. Due to its small size, the promoter-trojan can make the installation to be absolutely disguised. Sysinternals Antivirus strategy of ascendancy is to scare users with fabricated scan results. Showing tons of viruses Sysinternals Antivirus expects from users purchasing the full version to clean up the system and prevent all the ways of infecting. Nor Sysinternals Antivirus, either purchased activation code can do something with computer’s protection. Moreover, Sysinternals Antivirus does everything possible to maintain the infections invading your system. In order to do so, Sysinternals Antivirus will create new tears in targeted system and will disable all legitimate protection tools. Also, recent shipping of unreliable security statements are going to be on the first place of “to do” list for Sysinternals Antivirus. Such massages will display absolutely worthless information that is pointed on tricking innocent victims. All in all, trying to remove Sysinternals Antivirus from your computer is the most beneficial solution of this problem that is recommended to be done without delays.


Type: Rogue Anti-Spyware
Malware Author: Unknown

Threat Level: Critical
Screenshot:



How to remove Sysinternals Antivirus manually:
It's possible to remove Sysinternals Antivirus manually, but you have to be very experienced in dealing with registry entries, program files and .dll files.

The files to be deleted:

c:\Program Files\adc_w32.dll
c:\Program Files\alggui.exe
c:\Program Files\extra1.dat
c:\Program Files\extra2.dat
c:\Program Files\nuar.old
c:\Program Files\skynet.dat
c:\Program Files\svchost.exe
c:\Program Files\wp3.dat
c:\Program Files\wp4.dat
c:\Program Files\scdata
c:\Program Files\scdata\dbsinit.exe
c:\Program Files\scdata\wispex.html
c:\Program Files\scdata\images
c:\Program Files\scdata\images\i1.gif
c:\Program Files\scdata\images\i2.gif
c:\Program Files\scdata\images\i3.gif
c:\Program Files\scdata\images\j1.gif
c:\Program Files\scdata\images\j2.gif
c:\Program Files\scdata\images\j3.gif
c:\Program Files\scdata\images\jj1.gif
c:\Program Files\scdata\images\jj2.gif
c:\Program Files\scdata\images\jj3.gif
c:\Program Files\scdata\images\l1.gif
c:\Program Files\scdata\images\l2.gif
c:\Program Files\scdata\images\l3.gif
c:\Program Files\scdata\images\pix.gif
c:\Program Files\scdata\images\t1.gif
c:\Program Files\scdata\images\t2.gif
c:\Program Files\scdata\images\Thumbs.db
c:\Program Files\scdata\images\up1.gif
c:\Program Files\scdata\images\up2.gif
c:\Program Files\scdata\images\w1.gif
c:\Program Files\scdata\images\w11.gif
c:\Program Files\scdata\images\w2.gif
c:\Program Files\scdata\images\w3.jpg
c:\Program Files\scdata\images\word.doc
c:\Program Files\scdata\images\wt1.gif
c:\Program Files\scdata\images\wt2.gif
c:\Program Files\scdata\images\wt3.gif
c:\Program Files\Sysinternals Antivirus
c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe


Remove registry entries:

HKEY_CURRENT_USER\Software\Sysinternals Antivirus
HKEY_CLASSES_ROOT\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavapp"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavappr"


Please be careful because manual removal of Sysinternals Antivirus may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. So we strongly recommend you to use automatical removal tool.

No comments:

/