Posts Comments

You are here: Home / Virus Removal / Antimalware Removal Guide

Virus RemovalIf You Need Expert Help we recommend you hire a Ninja! Ninja's are well trained in the art of virus removal and can remove all threats from your computer right now. See this Computer Repair site or check out www.pcninja.com for live help.

Antimalware Removal Guide

January 15, 2010 By 1 Comment

This is a rogue software. It is a very bad program from the WiniSoft family. It is also a clone of System Veteran. AntiAid is one of the latest release from this malware family.This time, AntiAid has a different Graphical User Interface (GUI).

Anti Malware
Anti Malware

» Download Anti Malware Removal Software

This is the second time people behind the WiniSoft family will do that. For AntiAid, they are using the GUI from TRE Antivirus. The one being used for the others malware in the WiniSoft family is like System Warrior or Trust Fighter.

Be aware AntiAid has its own website, named AntiaidDOTcom . From that site, you can get a fake software toolkit called “Virus Protector”. This is simply AntiAid disguised. There are also lots of false information on the website.

The two main goals of AntiAid are: to compromise your computer system a lot and to try to get your money. AntiAid wants you to buy a fake online solution (the registered version). Programs like AntiAid usually stays resident in the background.

AntiAid uses Trojans to infect computers. They can be disguised as almost anything down-loadable: flash downloads, codecs, online scanner, fake softwares being pushed onto your computers by drive by download and more. All they want is to find a way to get installed unto your system.

The first thing any Trojan will do is to download AntiAid unto your system and install it.

AntiAid will then create many fake files in your main Windows directories, e.g. : C:Windows and C:WindowsSystem32 . Remember those files are harmless and fake. They will be used later by AntiAid to claim they are infections and security threats.

This malware will change your System Registry so it will boot itself on each logon .

The next step would be for AntiAid to do a fake system scan. You will get false reports of threats and such on your system. The files reported are those created before. An example of such a file can be “newfeat3.chm”.

AntiAid will also impersonate the Windows Security Center.

You will get lots of pop-ups, fake system notifications to tell you of some infection or many ones on your computer. You can also get them even if not online. Those pop-ups can try to trick you to download more malware and Trojans. You will also get reports your system is being attacked and your personal data can be stolen.

What you will read is that your computer has no protection. That you should register AntiAid to get a full system protection.
We have the Protection System removal instructions at the bottom of this guide.

Some symptoms of Anti Malware:

  • It will block security programs, either from running them or updating them
  • It will block you from acceding security related websites ; you might then be redirected to compromised ones
  • Your browser will be hijacked
  • It will disable applications like System Restore, Safe Mode, Task Manager, Registry Editor
  • You will get new desktop shortcuts. Clicking on them will redirect you to more compromised websites.
  • Your browser homepage might be switched for a compromised website
  • Your system will perform a lot slower than usual. The reboot time and the Internet connection might appear slower.
  • You might get frequent and automatic reboot. AntiAid might auto-reboot your system.

All of that is to scare you so you will eventually accept the solution AntiAid is showing you: to make an online purchase of a fake full version. This is a fake program as well. The full version is a scam and you will compromise your personal information.

We do recommend you scan your computer with the free trial of Spyware Doctor with Antivirus to see how infected you really are. If it is just this fake security product then follow the manual directions below. If you have other trojans and spyware applications then consider making a purchase of Spyware Doctor with Antivirus Here to remove all other threats and to keep your PC secure. If you follow the link above and use coupon code removevirus10 you will get 10% off. This is an exclusive coupon we got just for our readers.

As well we do recommend this remote computer repair company. They are the leaders in remote computer repair and can have you up and going in no time at all. This option is more for people who don’t feel comfortable removing viruses by themselves and just want an expert to do it for them.  Visit http://www.pcninja.com for more information.

Manual removal instructions for Anti Malware ( Please read our disclaimer below )

Kill Anti Malware processes: ( Learn How to Kill a Process Here. Opens in new Window )

  • AntiAID.exe
  • 2gbk87zj.exe  ( this process may be unique to your computer )
  • 8enyqcv1.exe ( this process may be unique to your computer )
  • m6axycx9.exe  ( this process may be unique to your computer )
  • uninstall.exe

We do recommend you run a full scan using Spyware Doctor with Antivirus » download. Even if you do not intend on registering the product it will help to stop the virus from re-installing and re-activating while you manually remove it. Also it will inform you of any new changes to the file names. You may need this if it mutates.

Delete Anti Malware registry values: ( Learn How to Edit Registry Here. Opens in new Window )

  • HKEY_LOCAL_MACHINESOFTWAREAntiAID
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallAntiAID
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “%System%8enyqcv1.exe”
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “m6axycx9.exe “
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “%ProgramFiles%AntiAID SoftwareAntiAIDAntiAID.exe -min”
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “AntiAID”

Delete files: ( Hint ) Most of these files will be in the %Program FilesProtection System directory.

  • %Documents and Settings%All UsersStart MenuProgramsAntiAID
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID1 AntiAID.lnk
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID2 Homepage.lnk
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID3 Uninstall.lnk
  • %Documents and Settings%All UsersDesktopAntiAID.lnk
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID1 AntiAID.lnk
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID2 Homepage.lnk
  • %Documents and Settings%All UsersStart MenuProgramsAntiAID3 Uninstall.lnk
  • %Documents and Settings%All UsersDesktopAntiAID.lnk
  • %Program Files%AntiAID Software
  • %Program Files%AntiAID SoftwareAntiAID
  • %Program Files%AntiAID SoftwareAntiAIDAntiAID.exe
  • %Program Files%AntiAID SoftwareAntiAIDuninstall.exe
  • %Temp%nss8.tmp
  • %Temp%nsj3.tmp
  • %Temp%nsn6.tmp
  • %Temp%2gbk87zj.exe
  • %Temp%8enyqcv1.exe
  • %Temp%m6axycx9.exe
  • c:WINDOWS100849pambotz85.bin
  • c:WINDOWS1019wo5m65bz.dll
  • c:WINDOWS10568hack9o5l5z5.dll
  • c:WINDOWSsystem322901sp55za.bin
  • c:WINDOWSsystem3229290wozm6795.cpl
  • c:WINDOWSsystem3229418tro5ez.ocx

Delete directories: ( Please note that in most cases everything in this folder can be deleted. Just be sure it’s the correct folder)

  • c:Documents and SettingsAll UsersStart MenuProgramsAntiAID
  • c:Program FilesAntiAID Software
  • c:Program FilesAntiAID SoftwareAntiAID
  • %Temp%

Please keep in mind that viruses mutate and change all the time. Do expect the above to change around a little. However this guide should work well for you and any experienced pro will be able to follow it and figure out the traces if they mutate. If you do not feel comfortable deleting files and the like then consider purchasing Spyware Doctor with Antivirus or have http://www.pcninja.com remove this and all other threats for you.

Leading Security Clients for you to consider ( Click the Links Below to Learn More )

  • Spyware Doctor with Antivirus
  • Norton
  • Trend Micro
  • Kaspersky
  • AVG
  • MalwareBytes
VN:F [1.9.10_1130]
Rating: 0.0/10 (0 votes cast)
VN:F [1.9.10_1130]
Rating: 0 (from 0 votes)
Filed Under: Virus Removal Tagged With: , , , ,
  • Anonymous

    I caught the latest, strongest version of this trojan/virus, AntiMalware 2010, on Windows 7 64-bit.

    It saved itself to my local profile, something Microsoft hides from user access.
    It disabled registry editing, making various system modifications, using improper versions of task manager, etc.
    I would kill ave.exe it in “task manager” and it would automatically reload itself.
    It disabled my installed (and active) antivirus software, Internet explorer.

    It still loaded when I booted into Safe Mode, which is really not supposed to happen.
    All of the built-in Windows 7 “security features” ended up working against me, and/or were easily exploited by this piece of crap software.

    If I had downloaded Malwarebytes software or any other anti-trojan software, I would have not been permitted to run them.

    I ended up removing the actual executables manually. To do this:

    Run “Task Manager”. Right click on the offending EXE, and choose properties – to find out where the executable is located on the file system.

    In my case it was “ave.exe”, located in c:\user\\applocal\ or similar.

    Reboot into Safe mode with command prompt

    At the command line, change to the directory where the offending exe is located.

    cd\
    cd c:\user\ \applocal

    You won’t be able to see the folder – Windows 7 hides it – uness you use

    dir /A

    Which will also show you hidden files and folders.

    run these commands against the executable, to remove system flags and delete the offenders

    attrib -s -h ave.exe

    del ave.exe

    there will also be a file or folder in the same directory that is a combination of letters and numbers.
    Use dir /A to find it, and then the attrib and del commands to remove it.

    There were also a number of files in

    c:\user\ \applocal\temp\

    A setup.exe, taskmgr.exe regedit.exe – fake copies of my system files.
    I used the attrib and del command on everything in this temp folder.

    When I rebooted into Normal mode, the trojan did not run, but I was still unable to run task manager, regedit, internet explorer, etc. Now my antivirus would run – but it didn’t detect or remove the trojan.

    I ended up browsing my hard drive to the actual iexplore.exe, right-clicking and chosing the “Start” option, downloading Malwarebytes Anti-Malware and performing a full scan.
    It was able to remove the registry entries that were modifying my system settings.

    Hypothetically, a third-party registry editor might also have worked here and I could have removed the rogue registry entires manually… but what a headache!

    I hope they find the people producing this thing and lock them away for life.

    VA:F [1.9.10_1130]
    Rating: 0.0/5 (0 votes cast)
    VA:F [1.9.10_1130]
    Rating: 0 (from 0 votes)
RemoveVirus.org cannot be held liable for any damages that may occur from using our community virus removal guides. Viruses cause damage and unless you know what you are doing you may loose your data. We strongly suggest you backup your data before you attempt to remove any virus. Each product or service is a trademark of their respective company. We do make a commission off of each product we recommend. This is how removevirus.org is able to keep writing our virus removal guides. All Free based antivirus scanners recommended on this site are limited. This means they may not be fully functional and limited in use. A free trial scan allows you to see if that security client can pick up the virus you are infected with.