Tech Support: I have started a new Forum on this site. If you have any questions/ problems, please ask them in this forum

Antivirus Pro 2010

Rogue - Antivirus

Antivirus Pro 2010 is reported to be a rogue application. There are several ways a fake/rogue application may enter into your computer.

1) You may have downloaded it knowingly or unknowingly mistaking it to be something else.
2) It may have automatically downloaded while you were visiting some harmful website
3) Your computer may have a trojan virus which in turn downloads such an application.


Recently I have noticed that the malware authors are also keeping track of the removal instructions published on the internet. As soon as they think that the malware is exposed, they change the file/folder names and the locations where they are saved on the hard disk. So keeping this in mind you will require the latest information of the malware in order to be able to remove it. You can see several latest analysis reports on this link

If you happen to have the rogue installer, you can submit it to threatexpert site and get it analyzed. That will help you to get the precise information about the virus.   


 Family

The other similar fake applications are Braviax family rogues - Home Antivirus 2009, Home Antivirus 2010, PC Antispyware 2010, PC Security 2009

Trying system restore

 If you know the duration since your computer is infected, you can try to restore your computer at a prior date, that will work like a miracle in removing the infection

Free removal tools

  • Special tools to remove a single virus or a family of virus.
  • Free Online virus scanners
  • Fully functioning antivirus/ antispyware
All these tools are listed below

Manual Removal

These are the steps to be taken, if you want to or need to remove the infected files manually

Boot in safe mode

Sometimes you will not be able to delete a file even if you find it, in that case you should boot in safe mode and then try to delete it/ them.

 Remove Processes from Task Manager 

Press Ctrl Shift Esc to open Task Manager. See in the list of the processes for a processe/s named "AntivirusPro_2010.exe"  select if found and press the End Process button, confirm and then close the Task Manager.

 Optionally you can use Windows Defender to see the path of a currently running program/ process and its publisher, so as to differentiate malware processes from windows genuine processes.


Or you can use Sysinternal's Process Explorer for easy detection and removal of virus processes. 

Removing entry from windows startup

The system configuration can be started in xp and in vista by typing msconfig in the run box/ start menu search box. In xp by clicking on Start > run . The windows startup is reversible, therefore you can check / uncheck any entry from windows startup any number of times.

After the system configuration window is open, Click on the Startup tab, that will list all the programs that are scheduled to start with windows. Expand the middle column using your mouse pointer so that you can see the full path of the program. Locate and uncheck  "AntivirusPro_2010"  (look for any other suspicious names)  Press Apply , Press Close/Ok , Select "Restart the computer" at the next prompt.

 View Hidden Files

Before you could delete Antivirus Pro 2010 and its associated files you need to search for them, and before doing that you need to enable to view hidden files and folders 

  •  How to Enable to View Hidden Files and Folders in Windows XP
    •         How to Enable to View Hidden Files and Folders in Windows Vista

Deleting files

After restarting the computer, use the windows search utility to search for "AntivirusPro_2010". This search will find all its folders on the hard disk , delete the folders from the hard disk. 

C:\Program Files\AntivirusPro_2010
Delete all the above folders if found.
Creates a file common in all infections
C:\WINDOWS\system32\_scui.cpl
Delete the file
Adds files with random names and extensions in the following directories, which are then used to display as fake infections. These files are different in different installations. probably you can't do anything about these files.

C:\Documents and Settings\All Users\Documents
C:\Documents and Settings\[username]\Application Data
C:\Documents and Settings\[username]\Local Settings\Application Data
C:\Program Files\Common Files
C:\WINDOWS
C:\WINDOWS\system32
It is also found that it can be downloaded by another trojan which adds the following files
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\dllcache\beep.sys
C:\WINDOWS\system32\dllcache\figaro.sys
modifies the following legitimate file
C:\WINDOWS\system32\drivers\beep.sys

 Run CCleaner

After deleting Antivirus Pro 2010 and its associated files , as there will be leftover entries in the windows regitry. CCleaner is a free temp files/registry cleaner, that will automatically clean the registry as well as remove the temp files . Click here to read more

 Edit Registry

if you are comfortable in using the regedit command.  You can find a list of all the registry modifications done by different variations of this rogue on this link.

More Problems

If you are unable to open Task Manager, registry editor, system restore, Folder Options etc

If the virus has disabled them. There are free tools and techniques to solve this problem.  They are listed here.

Tools for Windows XP

Tools for Windows Vista

Use the system file checker

If you want to make sure that the windows system files are not altered by the virus, and in case if they are altered then to repair them.

  •  How to run System File checker utility in windows XP
    •          How to run System File checker utility in windows Vista

Unable to access security related sites

It can happen if your Hosts file has been altered. To repair/ edit the hosts file. Login as administrator. open the following file in notepad
C:\ WINDOWS \system32 \drivers \etc \hosts
remove anything other than 127.0.0.1 Localhost, and save and close the file.

Using Firewall

Check your firewall for any suspicious communication from your computer to the internet and block it using firewall.

More help

Download/ install and run a free tool called TrendMicro Hijackthis. This program will generate a logfile "hijackthis.log" save it and mail it to support(at)comprolive.com for analysis.

 Reprinted with permission from ThreatExpert.com

Search within this site

Read in your language



Useful Links

Author's Profile


Free Download


HijackThis

Help is at hand


To make things easier, I will help you to find out viruses on your computer. To do that, You can send me a Hijackthis log.

Hijackthis is a free tool for Windows from TrendMicro. Download/install and run it, that will create a text file called hijackthis.log You can save this file on your hard disk.

You can mail it to me on support(at)comprolive.com Or you can post it in the forum on this site

Make your donations here


Select Amount