Super AV adds up to our category of rogue anti-spyware programs. This is by no means a typical antivirus program, although that’s exactly the impression you may get from the name. No, it’s something that just pretends to be benign but is in fact so malicious inside. Super AV usually uses drive-by downloads to penetrate into one’s computer. Basically, this means it’s really difficult to spot the moment it got inside. All it takes for this malware to intrude is just one click on some ad or other link when you’re online. After that, the program will be actively interfering with your computer usage, displaying fabricated scanners like the one shown on the image below, as well as loads of pop-ups that alert you in many different ways. The main idea of Super AV on this stage is to get you believing that your PC is at risk. It says you have worms (e.g. Worm.Reclog.A), trojan horses (like TrojanDownloader.Phexsol.B, Trojan.Hooblong.A), backdoors (Backdoor.Sajdela, Backdoor.Bigdipper.AB), exploits and other sample of badware. Among all the options and buttons on this utility’s interface, there’s one most prominent button reading ‘Register’ which is the most desired one by hackers for users to hit. They prompt you to buy the licensed copy of Super AV so as to handle all the supposedly detected infections. But even if you do pay the registration fee, it won’t do you or your computer any good. This will simply lead to the alleged elimination of the threats that never really were inside your system. Therefore it’s out of the question that Super AV should be removed as it is a virus that may harm your workstation.

Determine whether or not your computer is infected with Super AV scam:

Download Super AV Free Scanner with Remover

Super AV Snapshot:

How to remove Super AV manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %WINDOWS%\[random].exe

Remove the following associated registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Security” = “%Windows%\[random].exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “Debugger” = “[random].exe”

Please note that manual removal of Super AV is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Super AV Removal Tool

Sphere Security 2012 (aka SphereSecurity 2012) is not a mistyped name of a previously known rogue anti-spyware application (see this post). There has apparently appeared a new scareware with a slightly twisted name. What does it all mean to you as an average computer user and web surfer? Well, it doesn’t mean anything good actually. Sphere Security 2012 parasitizes on one’s Operating System to completely distort the way it works and try to persuade the victim about something that doesn’t correlate with the actual state of things. We would like to warn you before we proceed that this particular sample, just like its aforementioned clone, is hardly removable through your manual manipulations. This is because it’s problematic to single out the files related to it, as well as the corresponding bad Registry keys. Now, let’s see how this virus acts when on board. It usually starts with a scan that looks like it’s monitoring your system for security errors and malware threats. This impression is superficial though because Sphere Security 2012 does not really perform a PC check in the conventional sense of this word. This scan therefore comes up with a fake list of results stating that your computer is at risk due to the presence of multiple badware objects. The ‘repair’ recommended by this scam utility is simple: you grab your credit card and go to the registration screen to purchase the license for this tool. You probably know what will happen if you happen to do so. The malware will get a little less aggressive, and that’s the cost of the fee you paid. Does that sound comforting? Of course not. What is more, this specific virus is likely to get replaced by another one some time later. This means you have only one option – to remove Sphere Security 2012 scam for good.

Determine if your computer is infected with Sphere Security 2012:

Download Sphere Security 2012 Free Scanner with Remover

How to remove Sphere Security 2012 manually:

To perform manual removal of this infection, you should do the following:

Delete Sphere Security 2012 corrupt files:

• %Temp%\[random]\
• %Temp%\[random]\[random].exe

Remove the following associated registry entries:

• HKEY_CURRENT_USER\Software\[random]
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilte “Enabled” = “0″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1″

Please note that manual removal of Sphere Security 2012 is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Sphere Security 2012 Removal Tool

Believe it or not, the computer program bearing the noble name of Privacy Protection is a fake. At least the one that was launched today and looks just like what is provided on the image below. So what is it that you should know about this sample? In this post, we are going to tell you what you need to be aware of in this respect. The widespread path of Privacy Protection’s distribution is exploit-based or / and trojan-assisted. Whichever one you affect you, the process flow is the same on the outside. The virus gets in silently, without leaving traces that could be detected by your firewall and some legit AV tools. When this attack takes place, do not have too many illusions that it this process gets noticed on time and intercepted. It’s a matter of literally a second for a trojan to make its way inside and download the unwanted files to specified locations in your system. This being done Privacy Protection feels like a duck to water on your PC. It shoots out something like a scan that actually looks like it’s reflecting a computer check but does none of that in fact. This scan pursues just one goal: make things with your cyber security appear pretty complicated. Privacy Protection says it found many malicious objects as it lists them in the results interface. Concurrently, there will be some random pop-ups to enhance this brainwashing and imbue yet more fear into you. Some users, on learning such troubling information, rush to fix it all. That’s the moment they may take bait because Privacy Protection recommends a remedy. The fix is not free though. In other words, you will be told to submit a payment for license activation. Know what that means? It means the program is scareware. Know what is to be done with scareware? Right you are – it get removed ASAP. This is exactly what we strongly advise you get down to right away.

Determine whether or not your computer is infected with Privacy Protection scam:

Download Privacy Protection Free Scanner with Remover

Privacy Protection Snapshot:

How to remove Privacy Protection manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %Documents and Settings%\All Users\Application Data\[random]\[random].exe

Remove the following associated registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe”“Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0′
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Privacy Protection “DisableSR” = ’1′

Please note that manual removal of Privacy Protection is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Privacy Protection Removal Tool

System Security 2011 feeds you blank promises about help removing computer malware and expects you to fall for this and submit the money it is so keen on. Although this malicious product is new (released and exposed yesterday), the idea has definitely been around for months and has been observed in over ten very similar-looking scarewares. Just the few latest ones were AV Protection Online and Cloud Protection: just take a look at the images of these rogues to understand our theory. Let’s get back to where we were and try to dissect System Security 2011 in detail. This one gets into a PC through an exploit with active participation of a trojan virus. To save some time and spare you of redundant analyzing, we will just say such method of intrusion is detection resistant, meaning that neither your authorization nor firewall permission is required for the program to actually install. After the entrance stage is completed, System Security 2011 quickly advances into a more aggressive activity. The badware alters your Registry in a way by adding some keys and creates new files, including executable ones. So after the next PC restart, this malware will be in force to the fullest extent. The first visible thing it does is a scan that launches a few seconds after reboot. By the way, you can see for yourself what this scanner looks like (image below). It’s obvious all the potentially harmful items reported by System Security 2011 are something that is not there. These scary infections are just a hard-coded list that had been ready way before this application infiltrated your machine. Combined with some popup ads, this type of tactic is to intensely persuade you that there is no option except buying System Security 2011 license which is allegedly the only utility capable of fixing the PC. Still believe this software? We don’t.

Determine whether or not your computer is infected with System Security 2011 scam:

Download System Security 2011 Free Scanner with Remover

System Security 2011 Snapshot:

How to remove System Security 2011 manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %AppData%\[random]\
• %AppData%\ldr.ini
• %AppData%\svhostu.exe
• %AppData%\[random]\System Security 2011.ico
• %StartMenu%\Programs\System Security 2011\
• %StartMenu%\Programs\System Security 2011\System Security 2011.lnk
• %StartMenu%\Programs\Startup\crss.exe
• %System%\[random].exe
• %UserProfile%\Desktop\System Security 2011.lnk
• %Temp%\svhostu.exe

Remove the following associated registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random]“
• HKEY_CURRENT_USER\Software\System Security 2011

Please note that manual removal of System Security 2011 is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download System Security 2011 Removal Tool

AV Protection Online, a successor of Cloud Protection, is malware that contaminates one’s computer to specifically gain its makers profit. Fakeness of this program is beyond all doubt as its deliberate misinforming of users is a fact acknowledged by the whole antimalware community. Concerning the spreading specificity, it’s quite regular in terms of rogueware. The trojan horse distributing AV Protection Online tends to disguise itself as software that aims to provide you some assistance or optimize certain system processes. For instance, it is likely to come as a part of multimedia codecs, Flash player updates etc. It’s amazing that such a small fragment of corrupt code (we mean trojan) can cause such an immense mess inside your computer. It is well trained to spot weaknesses of your system and open backdoors, i.e. gateways in your security. It’s through these holes that AV Protection Online is literally dragged into a PC without even a hint of your awareness or consent. The presence of this awful tool on your workstation is always marked by the ‘standard’ scareware set: frequent fake scanners, bogus pop-ups – all multiplied by some general system work obstruction. This makes using a computer truly unbearable. AV Protection Online uses its phony positives arsenal to have you think a bunch of problems were found. It states you got trojans (e.g. Trojan.VBS.Qhost, Trojan-Downloader.JS.Remora, Trojan-Downloader.JS.Agent etc.), spyware and other really dangerous threats inside your OS. Since these parasites are apparently harming your machine and can put your privacy at risk of compromising, AV Protection Online persistently recommends you to try out a fix for their removal. But before you get to use that repair, it’s obligatory to pay for this software’s full version. This definitely makes the app a scam. Feel like letting it fool you around any longer? If not, be sure to terminate AV Protection Online.

Determine whether or not your computer is infected with AV Protection Online scam:

Download AV Protection Online Free Scanner with Remover

AV Protection Online Snapshot:

How to remove AV Protection Online manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %WINDOWS\system32\[random].exe
• %Documents and Settings\[UserName]\Application Data\csrss.exe
• %Documents and Settings\[UserName]\Application Data\hTrkd58DeORldrQAV Protection Online.ico
• %Documents and Settings\[UserName]\Application Data\Microsoft\csrss.exe
• %Documents and Settings\[UserName]\Desktop\AV Protection Online.lnk
• %Documents and Settings\[UserName]\Local Settings\Temp\[random].tmp
• %Documents and Settings\[UserName]\Start Menu\Programs\AV Protection Online\AV Protection Online.lnk

Remove the following associated registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random].exe”

Please note that manual removal of AV Protection Online is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download AV Protection Online Removal Tool

Today’s top malware is Cloud Protection. We spotted it during a regular web session and felt its awful impact to the fullest. Apparently the virus got through and ended up on our lab machine after a trojan made it inside first. This little pathfinder does a paramount work for compromising PCs, in the bad way of course. Its mission includes downloading most of the components of the to-be rogue antivirus. That being done, these fragments of the seemingly scattershot puzzle get configured to combine into a fully functional malignant program. This unexpected application then gets down to doing what it is meant to. It makes repeated attempts to baffle you by telling you that a variety of vicious infections were found on your machine during its scan. Some pop-ups added, Cloud Protection gradually moves close to its aim. This aspect of the fraudware’s activity is about intimidating you. It ‘exposes’ the infections that do not actually reside on your computer. What for? It’s done to get you doing thoughtless things due to this confusion and fear. Cloud Protection recommends that you get your PC cleared of the viruses by activating its cleaning function. The latter is a paid transaction though. As you can see, the pest will be satisfied only in case it gets your money. Hopefully your interests do not coincide with those of the rogueware in question. If so, be a smart person and uninstall Cloud Protection deceitful thing from your PC.

Determine whether or not your computer is infected with Cloud Protection scam:

Download Cloud Protection Free Scanner with Remover

Cloud Protection Snapshot:

How to remove Cloud Protection manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %Windows%\system32\[random].exe
• %Documents and Settings%\[UserName]\Application Data\[random]\
• %Documents and Settings%\[UserName]\Application Data\[random]\Cloud Protection.ico
• %Documents and Settings%\[UserName]\Application Data\ldr.ini
• %Documents and Settings%\[UserName]\Start Menu\Programs\Cloud Protection\
• %Documents and Settings%\[UserName]\Start Menu\Programs\Cloud Protection\Cloud Protection.lnk
• %Documents and Settings%\[UserName]\Desktop\Cloud Protection.lnk

Remove the following associated registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random].exe”

Please note that manual removal of Cloud Protection is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Cloud Protection Removal Tool

The basics of security knowledge should prompt anyone concerned that AV Guard Online is a program to avoid. It’s not only because we say so but also due to the numerous side effects it causes to your Operating System and your mental health. The application is extremely annoying and such a liar. It feeds you misinformation about virus protection level of your PC, stating that a large quantity of malicious objects have been intercepted during its scan. According to the computer security monitoring allegedly conducted by AV Guard Online, quite a few worms, adware and other potential risks are residing inside your system and may eventually lead to serious consequences unless removed. You have probably figured already these items are nothing to worry about because they do not exist (at least not on your computer). What you do need to be concerned about is the presence of AV Guard Online in your cyber neighborhood. Not only does it get obnoxious but may as well make your PC too weak to resist infections of different kinds such as actual spyware (not made-up), keyloggers, trojan horses etc. And that’s when you may face real problems. So take AV Guard Online rogueware seriously if it’s doing its dirty stuff on your computer. There is but one right thing to do that we know of in this case: uninstall this malware.

Determine whether or not your computer is infected with AV Guard Online scam:

Download AV Guard Online Free Scanner with Remover

AV Guard Online Snapshot:

How to remove AV Guard Online manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %WINDOWS%\system32\[random letters and digits].exe
• %Documents and Settings%\[UserName]\Desktop\AV Guard Online.lnk

Remove the following associated registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “AV Guard Online”

Please note that manual removal of AV Guard Online is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download AV Guard Online Removal Tool

The longer Security Guard 2012 rogue anti-spyware stays on your personal computer, the worse it all gets. This is an example of a nasty malicious utility possessing the ‘full house’ of badware features. It is stealthy, which means its appearance is usually a surprise even to those who care about cyber safety and consider themselves computer savvy. Most cases of contamination took place after visiting a compromised website with a bad script in its structure. Anyway, what happens next? When Security Guard 2012 gets on your PC, it changes system settings and makes sure its process gets triggered along with the legitimate ones. Moreover, the random named file responsible for this mess gets configured to overrun other executables, making it a real hard nut to crack opening, say, Microsoft Word, Notepad or the antivirus software you are using. When this rogueware is running, it shows you a great many alerts and even runs virus scanners looking like genuine ones. Now, please remember all of those are fakes. Security Guard 2012 is in no way fit to implement actual system protection routine, be it malware detection or removal of any infections. In spit of the inability to spot real threats, Security Guard 2012 goes even further and starts insisting that you purchase its commercial version. Honestly, the term ‘commercial’ sounds sort of funny in this situation as this program never was even close to legitimate. So it all adds up to this: this scareware detects fake infections on your workstation and then applies all its charm to convince you that your only option is to pay for its license. Do not fall for this shameful plan. Instead, go ahead and fight back. What you need to do is as follows. Restart your computer in normal or (preferably) Safe Mode (keep hitting F8 during the system boot). Then, go to Windows’ Start menu and select Run. Type in msconfig there and hit Ok or press Enter. Locate the tab called Startup and look carefully through the processes listed there. You are looking for the process that looks strange, something like 102938 consisting of random digits or other characters. You should uncheck this one and save all the modifications made. Your system will reboot at that point and will start a session without Security Guard 2012 running. That does not mean the virus is gone – next time you start your machine it will load up, or will be sure to find another way to restore itself. So you need to use reliable antivirus software to automatically exterminate all components of this malicious solution. This is what you can use the removal section of our post for.

Determine if your computer is infected with Security Guard 2012 scam:

Download Security Guard 2012 Free Scanner with Remover

How to remove Security Guard 2012 manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %Windows%\[random].exe
• %Documents and Settings%\[UserName]\Local Settings\Temp\[random].tmp
• %Documents and Settings%\[UserName]\Desktop\Security Guard 2012.lnk

Remove the following associated registry entries:

• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION “svchost.exe”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “Security Guard 2012″

Please note that manual removal of Security Guard 2012 is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Security Guard 2012 Removal Tool

OpenCloud AV is not really a new malware sample as it just continues the work started by its direct precursors one of which was OpenCloud Antivirus. Not only do these two look alike, they also do pretty much the same stuff to computers that were infected. How would you react to a program that installs itself without your consent, then keeps you from opening some applications and what is more, it fills up your screen with a lot of popup alerts. These warnings are a particular topic for discussion. They bear no info value at all, although they sure look like something you should take into consideration. OpenCloud AV uses this pop-up trick for a strictly defined reason – it tries to frighten you with confusing information about parasites that are purportedly overwhelming your computer, in the bad way. Beside the ads, this rogue software has another tool in store. It’s the fake system scanning that claims to disclose the real state of things with the safety of your machine. Each time these scans run and complete, they display reports that are full of pseudo infections listed. As you see, that’s quite a lot of effort towards making you believe some wrong things. OpenCloud AV tries to manipulate you by reporting nonexistent viruses and then recommending you exterminate them using its licensed copy. It’s early to be flattered by this program’s ‘helpfulness’. It won’t remove anything malicious for you just because there is none of it on your PC in the first place. OpenCloud AV is your only problem, no matter how well it disguises itself as a helper. So read below to learn how this particular infection can be eliminated without damage to your computer.

Determine if your computer is infected with OpenCloud AV scam:

Download OpenCloud AV Free Scanner with Remover

How to remove OpenCloud AV manually:

To perform manual removal of this rogue, you should do the following:

Delete the corrupt files listed below:

• %AppData%\OpenCloud AV\csrss.exe
• %Programs%\Startup\csrss.exe
• %Temp%\7.tmp

Remove the following associated registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList = “n;1;%ProgramFiles%\Common Files\Wise Installation Wizard\”

Please note that manual removal of OpenCloud AV is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download OpenCloud AV Removal Tool

What have you heard or known of Security Sphere 2012 application before? No matter what it was, we bet it was nothing good. There are several very relevant causes for this statement of ours. The traits of Security Sphere 2012 testify to its common roots with the Personal Shield Pro fake antivirus software. Likewise, it scans your computer just like a real PC cleaner but that’s only what the whole process looks like. In fact, the scan does not reveal any true facts about how your system is functioning for the moment and whether or not it has spyware on board. Security Sphere 2012 reports the things you don’t actually have. Those are pseudo worms, so-called adware, signs of spyware and similar bad notices for any average user. The good news is you don’t have the issues returned in this program’s scan results and the ads it displays. As always, there’s some bad news at the same time though. There’s something else Security Sphere 2012 wants from you, apart from the animated cartoons (we mean the scans and the false positives) it keeps triggering on you. The utility is thirsty for money which it wants you to pay for its commercial version. It’s namely this fact that makes Security Sphere 2012 a pure rogue all the way. In any case, believe us – you don’t need such ‘helper’ on your computer, hence the conclusion of the necessity to exterminate the brat from your system.

Determine if your computer is infected with Security Sphere 2012:

Download Security Sphere 2012 Free Scanner with Remover

This is what Security Sphere 2012 malware looks like:

How to remove Security Sphere 2012 manually:

To perform manual removal of this infection, you should do the following:

Delete Security Sphere 2012 corrupt files:

• %Temp%\[random]\
• %Temp%\[random]\[random].exe

Remove the following associated registry entries:

• HKEY_CURRENT_USER\Software\[random]
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilte “Enabled” = “0″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1″

Please note that manual removal of Security Sphere 2012 is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic removal tool below:

Download Security Sphere 2012 Removal Tool