Monday, February 13, 2012

Remove Security Scanner rogue (Uninstall Instructions)

Security Scanner is another product by notorious counterfeiters of security solutions. Its distribution is powered by several trojans and worms, as well as chains of websites persuade people into equipping their working stations with the security solution that turns out to be irritating and destructive trojan and a complete ignorant in threats recognition.
Once downloaded and installed onto computer the rogue retrieves basic system information and sends it to remote server. The remote server sends back further instructions, which may include the order to execute self-deletion. Most likely such order is issued, if IP does not satisfy a given criteria. Perhaps, users of Third World Countries would not be bombarded with the adware popups as it is unlikely to  benefit on their meager incomes so that the malware simply  abolishes itself. In the meantime, most of the users infected need to remove Security Scanner and require relevant extermination help. To get rid of Security Scanner and real viruses, get assisted by free scanner available here.

Security Scanner snapshots:




Security Scanner behaviour:
Security Scanner generates fake virus detection warnings and state that your PC is infected by: 
Backdoor:Win32/Hackdef.O, Virus.DOS.Lct.599, Virus.DOS.Silver.2071, Virus.DOS.Zerobug.1536.a, Trojan.Win32.KillWin.bl, Backdoor.Win32.RA-based, Trojan.Win32.Killav.k, and Backdoor.WinCE.Brador.a.
Security Scanner hijacks IE\Firefox homepage showing the following page:
Warning message from Internet browser. This page under virus attack. This may crash your system.

This may be caused by:

Virus content founded at this site trying to install its components.
Malicious & unknown network processes are determined.
Your system is under virus attack
Negative references from other citizens concerning this web page.
Your system ports and backdoors have been checked by visited page for external access.

Recommendations:

Obtain a license of "Security Scanner" to protect your PC for the safest browsing Internet pages (desirable)
Launch spyware, virus and malware scanning process.
Keep browsing

Security Scanner may block exe files (programs) showing the following alert:
"winword.exe" is infected with "Backdoor:Win32/Samsteal.A.dr".
Do you want to register your copy and remove all threats now?
Security Scanner displays the following popups:
Security Scanner Warning
Spyware.IEMonster process is found. This is virus that is trying to send your passwords from Internet browser (Explorer, Mozilla Firefox, Outlook & others) for the third-parties.
Click here to protect your data with Security Scanner.

Security Scanner Warning
Harmful software have been detected at your PC.
Click here to deactivate it.

Security Scanner Warning
Security Scanner has found viruses at your system.
We highly recommend to get license for Security Scanner to remove harmful software now.
Manual removal directions:
Try this activation code to "activate" Security Scanner:
64C665BE-4DE7-423B-A6B6-BC0172B25DF2
Than start manual removal process:

 Delete files created by Security Scanner:
%LocalAppData%\.exe
Delere registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "

 Rename the remover to "explorer.exe" or try to install from Safe Mode if virus blocks download\installation

1 comment:

Anonymous said...

Good solution..worked the manual solution for me.