HELP - Rogue Crapware?

[Momofabrood]

Installed IOBit Advanced Security Pro...

Everytime rebot computer AV Security Suite pops back up.

After scanning receiving this :

Rogue/Crapware.RegistrySmart / Critical

Told that it is fixed, run scan again and there it is!

Eventually brings up porn site after porn site... and appears to attach to everything.

ANY advice on what next?

[pyrath]

Removal instructions for Adware RegistrySmart:

 

To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

 

@@@://www.emsisoft.com/en/malware/?Adware.Win32.RegistrySmart

[3H48002Y4]

Hi

 

Run a system restore to a date before you received the Infection.

 

Or if u cant run a system restore.

 

Download this and run it then

 

 

Download malwarebytes

 

and run it

 

To Remove by delete

 

Need to Delete AV Security Suite Files:

 

%Documents and Settings%\[userName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe

%Documents and Settings%\[userName]\Local Settings\Application Data\[random characters ]\[random characters].exe

 

Need to Delete AV Security Suite Registry Entries

 

HKEY_CURRENT_USER\Software\AvScan

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random characters]“

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “[random characters]“

HKEY_CURRENT_USER\Software\avsoft

HKEY_CURRENT_USER\Software\avsuite

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “<local>”

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″

Need to Delete AV Security Suite Files:

%Documents and Settings%\[userName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe

%Documents and Settings%\[userName]\Local Settings\Application Data\[random characters ]\[random characters].exe

[So_sad]

This infection can be a bit difficult to remove without the proper sequence and tools, folks.

 

Momofabrood : let's do this right. Please follow these instructions :

http://forums.iobit.com/showthread.php?t=6216

 

A moderator/admin will then move your topic to the appropriate section of the forum.

 

Good luck :-)

 

===

[Momofabrood]

AV Security removal

 

I downloaded the suggested products and the crud on my computer tells me it is infected so I can not open - IOBit says all is clear but it iw not.

 

Are you saying I can manually delete this stuff? I went to my documents / applications, etc.. i can not find anything that says AV.

 

I am not great on the computer so any specific directions would be great. Thanks.

[Momofabrood]

AV Security Removal

 

I can not open or run anything that you all suggested that I install to clear away this AV Security thing

[enoskype]

Hi Momofabrood,

 

I have copied your posts to Spyware-Malware Removal Help! section, please wait for a Malware Fighter to help in that section.

 

I will leave this thread open if other members would like to help here untill you get a response in Spyware-Malware Removal Help! section.

 

Cheers.

 

EDIT: Since there is a response in Spyware-Malware Removal Help! section, this thread is closed.