Remove Best Virus Protection. Removal instructions
Best Virus Protection is a rogue security product taht is being promoted mainly through the use of Trojans and fake online virus scanners. It uses misleading techniques to make it difficult to remove the rogue program from the infected computer. Scareware disables Task Manager and other system tools so that you cannot end the processes associated with Best Virus Protection. It closes legitimate security applications to protect itself from being deleted from the system. Best Virus Protection automatically scans your computer for malware and displays a list of non-existent infections to scare you into thinking that your computer is infected. If you attempt to remove any of these infections, though, it will state that you first need to purchase the program to do so. Please do not pay for this rogue antimalware program and use the removal instructions below to remove Best Virus Protection from your computer using our recommended malware removal program
Once installed, Best Virus Protection will display many fake security alerts and pop-ups about non-existent viruses and security threats on your computer. Some of the fake security alerts read:
Warning! Virus Detected
Threat Detected: Trojan-Spy.HTML.BankFraud.ra
Recommended: Please click “Remove All” button to erase all infected files and protect your PC.
Address space conflict
Warning! Access conflict detected
An unidentified program is trying to access system process address space.
As you can see, Best Virus Protection is nothing more but a scam. It goes without saying that you should not purchase this misleading program, and if you have, please contact your credit card company and dispute the charges. To remove Best Virus Protection from your PC please use the removal guide below. We strongly recommend you to use Spyware Doctor or other anti-spyware program to remove all infections from your computer. If you can’t run anti-malware software, please reboot your computer in safe mode with networking and try again. The rogue program modifies Windows host file so that you may not be able to visit certain sites. You can remove additionally added lines in hosts file manually.
Automatic Best Virus Protection removal:
(2012-03-07 08:28:40)
(2012-03-07 08:28:40)
(2012-03-07 08:28:40)
Best Virus Protection manual removal:
Kill processes:
[random].exe AV9c5_8046.exe scandsk211d_8046.exe ASa76.exe eb.exe runddlkey.exe
how to kill malicious processes
Delete registry values:
HKEY_LOCAL_MACHINE\Software\Classes\clsid\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
Default = Implements DocHostUIHandler
LocalServer32 = %AllUsersProfile%\Application Data\5c678c\AS9c5_8046.exe
ProgID = AS9c5_8046.DocHostUIHandler
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPro_2010.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirus_Pro.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cl.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe\
Debugger = svchost.exe
HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\dop.exe\
Debugger = svchost.exe
how to remove registry entries
Unregister DLLs:
mozcrt19.dll
how to unregister malicious DLLs
Delete files:
%AllUsersProfile%\Application Data\5c678c\ %AllUsersProfile%\Application Data\5c678c\sqlite3.dll %AllUsersProfile%\Application Data\5c678c\ASPSys\ %AllUsersProfile%\Application Data\5c678c\BackUp\ %AllUsersProfile%\Application Data\5c678c\Quarantine Items\ %AllUsersProfile%\Application Data\5c678c\582.mof %AllUsersProfile%\Application Data\5c678c\AS9c5_8046.exe %AllUsersProfile%\Application Data\5c678c\ASP.ico %AllUsersProfile%\Application Data\5c678c\mozcrt19.dll %AllUsersProfile%\Application Data\ASLNP\ %AllUsersProfile%\Application Data\ASLNP\ASUUDJRRJXP.cfg %AppData%\Best Virus Protection\ %AppData%\Best Virus Protection\cookies.sqlite %AppData%\Microsoft\Internet Explorer\Quick Launch\Best Virus Protection.lnk %UserProfile%\Desktop\Best Virus Protection.lnk %Temp%\scandsk211d_8046.exe %UserProfile%\Start Menu\Best Virus Protection.lnk %UserProfile%\Start Menu\Programs\Best Virus Protection.lnk
how to remove harmful files
Information updated: 2012-03-07 08:28:40