DP's Security Bits : Malware Removal Guide

Removal instructions for Vaccine-365

Don — Wed, 22 May 2013 08:46:00 GMT

What is Vaccine-365?

The Malwarebytes research team has determined that Vaccine-365 is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=126666

Spamhaus Ransomware Removal Guide - Updated May 21, 2013 (Uninstall Instructions)

Don — Tue, 21 May 2013 19:14:00 GMT

The Spamhaus Ransomware is computer infection that displays a a screenlocker so you can not access your desktop and applications and encrypts your files. When infected with this malware, you will be presented with a screen when you login to Windows that pretends to be from the Spamhaus Project. This screen states that they have detected your computer participating in illegal activities and have blocked access to it until you pay a fine. This infection will also scan your computer for files that end with the .ddrw ,.pptm ,.dotm ,.xltx ,.text ,.docm ,.djvu ,.potx ,.jpeg ,.pptx ,.sldm ,.xlsm ,.sldx ,.xlsb ,.ppam ,.xlsx ,.ppsm ,.ppsx ,.docx ,.odp ,.eml ,.ods ,.dot ,.php ,.xla ,.pas ,.gif ,.mpg ,.ppt ,.bkf ,.sda ,.mdf ,.ico ,.dwg ,.mbx ,.sfx ,.mdb ,.zip ,.xlt extensions and then encrypt them. When the ransomware encrypts a file it will rename it as a HTML file and then embed the encrypted file inside of it. If you then attempt to launch any of these encrypted files, you will be taken to a web page, which is currently at http://xblblock.com, that prompts you to pay the ransom in the form of a MoneyPak voucher

http://www.bleepingcomputer.com/virus-removal/remove-spamhaus-ransomware

Remove the Computer Crime and Intellectual Property Section Ransomware

Don — Sat, 18 May 2013 09:30:00 GMT

The Computer Crime and Intellectual Property Section ransomware is a computer infection that displays a screen requesting money before it allows you to access your Windows desktop. This screen locker pretends to be an alert from the FBI that states they have detected that you have been viewing child pornography, using unlicensed software, or distributing copyrighted files. They further state that in order to avoid federal prosecution you must pay a fee of $300 in the form of a MoneyPak voucher within 72 hours to gain access to your computer again.

http://www.bleepingcomputer.com/virus-removal/remove-computer-crime-intellectual-property-section

Removal instructions for Boan Safe

Don — Sun, 12 May 2013 11:12:00 GMT

What is Boan Safe?

The Malwarebytes research team has determined that Boan Safe is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=126166

Removal instructions for Booster-Clean

Don — Sat, 11 May 2013 09:16:00 GMT

What is Booster-Clean?

The Malwarebytes research team has determined that Booster-Clean is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=126120

Removal instructions for VaccineTools

Don — Sun, 05 May 2013 10:03:00 GMT

What is VaccineTools?

The Malwarebytes research team has determined that VaccineTools is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125872

Malwarebytes: How to remove the Security Pro rogue

Don — Sat, 04 May 2013 10:37:00 GMT

The Security Pro rogue hijacks the .exe extensions and effectively blocks other programs. It can also delete wuauserv and disables shared access.

http://www.youtube.com/watch?v=YVf14ef6uC4

Removal instructions for XP Security Cleaner Pro

Don — Sat, 27 Apr 2013 17:49:00 GMT

What is XP Security Cleaner Pro?

The Malwarebytes research team has determined that XP Security Cleaner Pro is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125615

Removal instructions for Boan Solution

Don — Wed, 24 Apr 2013 09:51:00 GMT

What is Boan Solution?

The Malwarebytes research team has determined that Boan Solution is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125502

Removal instructions for iON internet security from cloud

Don — Sun, 21 Apr 2013 11:28:00 GMT

What is iON internet security from cloud?

The Malwarebytes research team has determined that iON internet security from cloud is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125394

Malwarebytes: How to remove the Reveton ransomware

Don — Sun, 21 Apr 2013 08:43:00 GMT

The latest ransomware called Reveton (aka Police Trojan) poses as various law enforcement agencies. Users are then warned that they have flagged for illegal activities and thus locked out of their own system. To regain their machine, users are prompt to pay a fine.

http://www.youtube.com/watch?v=x4DJvB6BOX4

Removal instructions for System Care Antivirus

Don — Sat, 20 Apr 2013 12:47:00 GMT

What is System Care Antivirus?

The Malwarebytes research team has determined that System Care Antivirus is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125373

Spamhaus Ransomware Removal Guide (Uninstall Instructions)

Don — Sat, 20 Apr 2013 09:27:00 GMT

http://www.bleepingcomputer.com/virus-removal/remove-spamhaus-ransomware

How to remove Vista Security Cleaner Pro (Uninstall Guide)

Don — Sat, 20 Apr 2013 09:26:00 GMT

Vista Security Cleaner Pro is a computer infection from the Rogue.FakeRean-Braviax family of rogue anti-spyware programs. This infection is considered a rogue anti-spyware program because it purposely displays fake scan results, false security warnings, hijacks your web browser, and does not allow you to run your legitimate Windows applications. This scareware is promoted through hacked web sites that attempt to install the software by exploiting vulnerabilities on your computer. It is also promoted through Trojans that pretend to be legitimate programs, but will install the infection instead when you run them.

http://www.bleepingcomputer.com/virus-removal/remove-vista-security-cleaner-pro

Removal instructions for AVASoft Antivirus Professional

Don — Sat, 20 Apr 2013 09:25:00 GMT

What is AVASoft Antivirus Professional?

The Malwarebytes research team has determined that AVASoft Antivirus Professional is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue.

http://forums.malwarebytes.org/index.php?showtopic=125369

XP Security Cleaner Pro Removal Guide

Don — Sat, 20 Apr 2013 09:24:00 GMT

XP Security Cleaner Pro is a computer infection from the Rogue.FakeRean-Braviax family of rogue anti-spyware programs. This infection is considered a rogue anti-spyware program because it purposely displays fake scan results, false security warnings, hijacks your web browser, and does not allow you to run your legitimate Windows applications. This scareware is promoted through hacked web sites that attempt to install the software by exploiting vulnerabilities on your computer. It is also promoted through Trojans that pretend to be legitimate programs, but will install the infection instead when you run them.

http://www.bleepingcomputer.com/virus-removal/remove-xp-security-cleaner-pro

Win 7 Security Cleaner Pro Removal Guide (Uninstall Instructions)

Don — Sat, 20 Apr 2013 09:23:00 GMT

Win 7 Security Cleaner Pro is a rogue anti-spyware program from the Rogue.FakeRean-Braviax family of computer infections. This infection is considered a rogue anti-spyware program because it purposely displays fake scan results, false security warnings, hijacks your web browser, and does not allow you to run your legitimate Windows applications. This scareware is promoted through web sites that have been hacked with scripts that try to install the software by exploiting vulnerabilities on your computer. It is also promoted through Trojans that pretend to be legitimate programs that are required to view an online video, but instead install the infection.

http://www.bleepingcomputer.com/virus-removal/remove-win-7-security-cleaner-pro

Remove System Care Antivirus (Uninstall Guide)

Don — Wed, 10 Apr 2013 09:04:00 GMT

System Care Antivirus is a computer infection from the Rogue.WinWebSec family of rogue anti-spyware programs. This program is categorized as a rogue because it pretends to be an anti-virus program, but instead displays fake scan results, fake security alerts, and blocks you from running your normal applications. This program is distributed through hacked web sites that exploit vulnerabilities on your computer and as Trojans disguised as a program that is necessary to view an online video. This particular variant is also known to be installed with the ZeroAccess rootkit, which makes it harder to remove and clean your computer.

Once installed, System Care Antivirus will be configured to start when you login to Windows. Once started, it will perform a fake scan of your computer that will state that numerous infections are present. If you try to clean these infections, though, System Care Antivirus will state that you first need to purchase the program before being able to do so. As all of the scan results displayed by this program are fake, please ignore any prompts to purchase the program.

http://www.bleepingcomputer.com/virus-removal/remove-system-care-antivirus

iON Internet Security Removal Guide

Don — Wed, 10 Apr 2013 09:02:00 GMT

iON Internet Security is a rogue anti-spyware program that pretends to be a legitimate anti-virus program, but instead displays false alerts and fake scan results in order to scare you into purchasing it. This program is distributed through hacked web sites that have exploit kits installed on them. When a person visits one of these hacked sites, the exploit kit will check for vulnerable programs installed in your web browser and then attempt to exploit them to install iOn Internet Security without your permission or knowledge.

http://www.bleepingcomputer.com/virus-removal/remove-ion-internet-security

Remove the Department of Justice Ransomware (Uninstall Guide)

Don — Thu, 04 Apr 2013 16:48:00 GMT

The Department of Justice ransomware is a computer infection that displays a screenlocker that does not allow you to access your Windows desktop until you pay a ransom. This screenlocker pretends to be an alert from the United States Department of Justice that states they have detected that you have been viewing child pornography, using unlicensed software, or sharing copyrighted files. They further state that in order to avoid criminal prosecution you must pay a fee of $300 in the form of a MoneyPak voucher within 48 hours to gain access to your computer again.

http://www.bleepingcomputer.com/virus-removal/remove-department-of-justice-ransomware