Comments on: Windows Antivirus Pro

By: heru nurhadi

heru nurhadi — Thu, 01 Apr 2010 04:10:46 +0000

can you help me, my notebook can’t read flashdisk… thanks

By: Tyler

Tyler — Tue, 09 Mar 2010 01:34:50 +0000

I just got hit with WAP this morning. Windows Vista.

At first, there were just lots of annoying pop-up ads. I wasn’t sure if this was trial software that had come with my computer, rather than a legitimate problem. After a few hours, it began to refuse to allow me to open applications. At this point, I realized I need to take action. I downloaded malwarebytes AND Spyware Doctor to an alternate laptop, and introduced them to my comp via flash drive. It did not want to open the files (repeatedly asking “which program would you like to use to open this?” but then refusing to do so). However, I got by this by right-clicking and selecting “Open as administrator.” I installed both programs, and ran malwarebytes, which found 3 infections. I deleted them, and it said it needed to restart my computer. I restarted. Now my computer is giving me an error message and won’t start windows, either in safe or normal mode. This blows.

By: Bill

Bill — Sun, 07 Mar 2010 00:52:25 +0000

Here’s my findings on our Vista system. My wife’s computer got hit with this this morning. I ran a scan (we have subscription for Norton 360) and it said everything was fine. I logged into a different user and didn’t see it, so it was isolated to my wife’s login, apparently. I logged back in to her account and within a minute was bombarded with all the noxious dialogs.

I found the problematic file to be C:\Users\Roxanne\AppData\Local\av.exe (my wife’s name is not Roxanne – this is to preserve her anonymity ). I deleted that file, along with another file in that same folder with a funny name like n0al that had the system attribute set, and was created this morning same time as the av.exe, but was being modified throughout the day. I searched the entire hard drive for other files with a create date of today and found nothing else suspect. It does appear that at 7:41am there was a Java update done, which could have been the means by which this bad boy got in the door.

I then looked for av.exe in the registry and found it buried in .exe and secfile keys under HKEY_USERS\S-1-5-21-601332560-1032211926-102831608-1001\Software\Classes. Note that there were several different long-name keys like the above under HKEY_USERS, but only this one had the bad info. I have a Windows 7 machine myself, and checked that registry, and found no keys at all for .exe or secfile under HKU\…\Software\Classes, so I deleted the entire .exe and secfile keys from the registry.

There was also an muicache entry for it, which I think was probably benign since I deleted the av.exe file, but I deleted that key from the registry as well. This seems to have done the trick.

Hope this helps someone!

By: countryslim

countryslim — Sun, 21 Feb 2010 09:55:40 +0000

Hey all.. I’ve working on a friends laptop and This Win AV pro virus is massive and mean. I have been using A-Squared Free version 4.5 with updated Trojan/Sig/Trace files and so far I’ve found windows police pro and win AV pro trojans and downloaders. another progran I have used is JV16 powertools which is an old freeware program I’ve used with win 98, ME, XP pro and XP home. One thing I’ve found with this is if a progran won’t open, run or install, got to C: program files, find the program to open, right click on the exe file and click run as, below the user, uncheck the box that says prevent programs or protect, then the files will usually run or install. It works in Windows also. I had to use that method to install both JV16 A-Squared free from a memory stick. I’m not done yet but so A-Squared A2 free has found abound 10 high risk trojans out of 35 infected files.

By: Mike D

Mike D — Fri, 12 Feb 2010 15:55:06 +0000

I got rid of it by booting to safe mode with networking, and using Malwarebytes Anti-Malware

By: Matt

Matt — Sat, 12 Dec 2009 21:12:10 +0000

ive tried every suggestion but i still cant open task manager to kill the processes. i can get it to open but only for a split second and then itll be closed by windows antivirus pro. i really need help with this first step!

By: admin

admin — Fri, 04 Dec 2009 07:34:24 +0000

Laura: these change process names more or less randomly. Try looking for sysguard.exe, also check all processes run under your user in google – if it is not legitimate process, stop it.
Also… have you updated malwarebytes? Have you tried other removers, like Spyware Doctor? The problem is Malwarebytes free version does not give real time protection and updates are manual… so if it is single anti-malware, users get reinfected often.

By: Laura

Laura — Thu, 03 Dec 2009 14:24:15 +0000

I have the Win Antivirus Pro crap on my laptop. It has blocked everything and has now gone to the point of launching the internet to porno sites and viagra ads! NICE right? I am only able to run any program as long as once my desktop appears after rebooting my machine, I double-click on the program to run immediately before WAP stops me. I was able to run malwarebytes and mcafee. Malwarebytes found and quarantined a total of 9 files and mcafee found nothing. None of what was found stopped WAP! I used the file above to access task manager and none of the associated processes or files are listed (i.e. Windows AntivirusPro.exe and svchast.exe, etc…). I searched for all the files on my system and found nothing. I got rid of this horrible thing about 3 months ago but those files were listed so it was easy. This time is ridiculous! HELP!

By: admin

admin — Tue, 24 Nov 2009 08:35:15 +0000

Brendan : Check your registry for your browser executable name. Some viruses mess with registry so you execute completely different program when you try to execute explorer, firefox or other program.

By: Brendan

Brendan — Mon, 23 Nov 2009 20:31:28 +0000

I have managed to get my laptop working by loading superantispyware to a memory stick via another PC and running the program from the memory stick. It got reid of the false security alerts and I am now able to access files and e-mail. However I am still unable to open a web browser. Any ideas?

By: Chancey

Chancey — Wed, 11 Nov 2009 23:50:47 +0000

rogxsysguard.exe

Removing this process aided in removing windows anti virus pro. I still had to scan with malwarebytes but I stopped getting fake alerts and the virus pro icon went away after i ended this process.

By: Chris

Chris — Sat, 07 Nov 2009 05:23:41 +0000

Thanks!!!!
Finally got ride of it

By: admin

admin — Thu, 05 Nov 2009 12:45:44 +0000

Google for each process name, Chris. We list most common process names for this parasite and related trojans, but sometimes they change the names. If you can’t find on internet a legitimate program that uses same process name, then you can stop that process.

By: Chris

Chris — Thu, 05 Nov 2009 05:59:31 +0000

What do you mean by looking up all processes under my user? and stopping the ones i can’t find?

By: admin

admin — Wed, 04 Nov 2009 07:50:06 +0000

chris : you should go with first step of manual instructions. Stop virus processes (if your version of trojans differ, you will have to look up all processes under your user in the web, and stop ones you can’t find).
Then download remover, it should work.

By: Chris

Chris — Wed, 04 Nov 2009 01:38:34 +0000

Hey
I can’t use my antivirus software (i downloaded the ones that were recommended) and i can’t find any of the files listed above.When i search for the program or the files, none can be found. Are there any other names the virus can use?

I read all of the previous posts but the suggestions don’t work for me and/or i don’t know how to do it.

I’m not good with computers, so whatever the suggestion, if you could give me the basic steps it would be appreciated!

Please help, i really don’t know what to do.

By: ovides picard

ovides picard — Mon, 02 Nov 2009 15:37:36 +0000

how do i reinstall window antivirus pro on my computer. please send me the steps. thank you

By: admin

admin — Mon, 19 Oct 2009 11:33:10 +0000

Check proxy settings, paulina. It might be there is a proxy set up in your browser.
Also, check your hosts file.

By: Mark

Mark — Mon, 19 Oct 2009 00:52:02 +0000

ok, that last emote came out wrong… it was supposed to be a frowny face.

By: Mark

Mark — Mon, 19 Oct 2009 00:51:14 +0000

Ok, here’s my problem. I could only locate one of the files listed in all of that text above. and yes i read it ALL. I have nothing in the task manager, nothing in the system32, nothing from any of the anti-spywware programs, and the Windows AntivirusPro window keeps poping up. And yes, I ran all the updates that my computer allowed me to for everything.

Im out of ideas