AV Security Suite

Is the fake security client icon on your desktop? If so you can right click on the and get the file path that way.

The file path should be something very similar to the video. However it may have mutated and changed since then. If you are able to download and install security clients then you should download Spyware Doctor with Antivirus and run a quick scan to find the file paths.

You may also be able to install the client in safe mode with networking if all else fails.

The only other thing I could suggest is to go to the run bar and type “msconfig” with out the quotes. Look at the startup items and see what is located in the folder we told you to look into. If it looks like this fake client then chances are it is. You can then go to that path and check it out yourself.

report back your results and file name as well as location.

hello. i have watched the first video quite a few times and read the manual instructions as well. i have changed my folder settings to show hidden as well, but once i get to %User%\AppData\Local\ i cant find any random letters.

OK, I followed the steps in the video again and then ran Malwarebytes and it identified a few more things (asam.exe, syssvc.exe) which I removed manually and searched the Registry to also remove other entries that appeared to relate to those files. I ran Malwarebytes in Safe Mode and it found a few more file that I also allowed Malwarebytes to remove. So far, so good. AV Security Suite has not re-appeared…..yet.

Now, my question:

In your step-by-step you say to remove the the following file (for XP):

“%Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe”

OK, but what about the folder in which that file resides? IOW, after you remove [random characters]tssd.exe should you go back and then remove the folder, too?

That is, should you finally remove this? –
“%Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]”

Thanks,
Mike McCarthy

a way to search you computer for the virus with out the virus stopping your every move is tho start your computer and as some as your screen comes up press ctrl+ alt+delete and it open task manager before the virus turn on give you the ability to end the process and search your computer

I am still curious to know where the virus had come from? I know I load some things like pageragefrom facebook, but I’m not sure if that had been what had infected my computer. I haven’t seen anyone mention where they might have gotten it from. Any information on what i can do to keep that from happening again would be great

Thank you

Hi the last two Registry Entries that we need to delete:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “[random]”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “[random]”

I have opened these two areas in Regedit, but I am not too sure what we should delete, should we just delete all that is in BOTH of these, are am I looking for something ‘Random’ that doesnt look right to delete?

Apart from this final part that I am slightly unsure about, this tutorial and accompanying videos were/are top notch and much appreciated.

If I could just get a little help in regard to the above question re: regediting, I’d be extremely happy and even more grateful.

You have a secondary infection. Most likely a trojan that is re-installing the other virus and probably a whole lot more. You need to run the full scan using Spyware Doctor with Antivirus to see what that other infection is. Then delete those traces manually.

The “Random” file is going to be your unique infection number. The only way to know what this is was when you went and found the actual file trace as instructed in the guide and video.

My advice to you is to run a full scan with Spyware Doctor with Antivirus and let that program tell you the exact locations and file traces that you need to delete.

Followed the instructions to a T and all seemed OK. A few hours later, the AV Security Suite showed up again, installing a new one of these –

%Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe

I suppose the bad Registry entries (which I previously deleted) are there, too.

I’m starting over, but why would the removal procedure work on the second try if it didn’t work on the first?

Sure hope someone has some advice.

Thanks.

Hi Mike.

You do not have to remove the folder. It will cause zero harm and your computer will never care. However we do recommend you remove the folder because it serves no use. Chances are as this threat gets older your security program will auto pick this folder up and remove it for you. The choice is 100% yours.

OK. In either case — removing or not removing — the virus returned. I don’t want to spend $40 on Spyware Doctor. I have restored the entire disk from a backup that predates the infection.

This is my daughter’s computer and she uses it mostly for chat and saves all docs in default locations so I doubt anything was lost by going to an “old” backup and bringing her “new” docs with us (unless the infection is somehow included with her “new” docs).

And, I cannot tell you where she picked up the infection, or what mistake she made — if she made any — that allowed the infection to occur.

I have a few of the most commonly recommended anti-spyware freeware, and I have an annual subscription to Iolo for their Disk Mechanic which includes antivirus software (which updates every few days).

Clearly, what I am using did not block/remove “AV Security Suite” so what I’m using by definition is not adequate. The thing is, NONE of these malware-fighting programs are adequate. You need a whole toolbox of them, and I’m just not going to spend $40 on yet another tool that might or might not work on my current problem, and might or might not work on future problems.

Thanks anyway for the help.

Spyware Doctor with Antivirus works and that is why we recommend it. However your points are very well noted. Just keep in mind that almost all free clients out there do NOT offer real protection. They block 0 infections. They kick in only after a virus has been installed and by then it’s often too late.

I would recommend because this is your daughters computer that you setup a limited user account for her. That way she will not be allowed to install programs. This small step can go a VERY long ways in protecting the computer. In your case I think this is perhaps the best solution for you. I also will agree that she most likely did nothing wrong. Doing homework research and other similar things can very easily lead to a site that has been hacked and have malicious code on it.

Read more about it on this page http://www.removevirus.org/how-create-and-limit-a-user-account-661

I had been able to rid my computer of the pesky av security but still couldn’t connect to the internet. Thanks so much for reminding me ab out making sure IE does not have the proxy settings box checked.

Thanks! Works great. Scanning with Windows Defender right now, hopefully it is good enough to see if there is a trojan remaining from this annoying program.

You did not mention anything about running a virus scan or having protection on your computer so my guess is you got re-infected. These viruses are rather simple types of threats for the most part. While many come with trojans, keyloggers,bots and backdoors the threat of the fake security client is a simple one. Run a full scan using Spyware Doctor with Antivirus and see what it finds. There should be zero need for reloading a backup. However it’s great to hear someone actually using backup software like Acronis. That is what I use on all my personal and business computers.

I ran a repair on Microsoft Office which includes Outlook and that sorted out the problem. No problems before AV SS arrived, so it did something to Outlook that was not obvious from setting the account settings.

I was so upset. I was streaming online tv episodes when this AV antivirus this started popping up. Very frustrating! But removing it was very simple thanks to your page. Thank you for all your help!

every thing worked up till the file that was supposted to be unique to everyone. it’s not on my computer. is there someting i should be doing differently?

I seem to have removed the AV virus client, but my search engines on yahoo and google now redirect my search inquiries to advertising type pages. Is this problem likely related to the AV client?

The answer is yes. Re-set IE.

Boot into safe mode with networking. Download and run a scan with Spyware Doctor with Antivirus to identify what the name of the files are on your computer. Then follow the rest of the guide.

Malwarebytes and SUPERAntiSpyware should of been able to pick this threat up if it were present on the system at the time of the scan. My guess is you got re-infected after wards. However a hidden root kit might be the cause if you did not have a backup that was 6 months old and zero chance of re-infection from this because it did not exist 6 months ago.

Even the best security clients in the world together will not fully stop users from infecting themselves. When warning messages are ignored and the like your computer will get infected.

I would not be too hard on your daughter. No proof just suspicions. However you should create for her a separate user account that has limited access. That way she can not install programs and will give you better monitoring power.

I would also disable the IOLO antivirus because that may interfere with the other two superior security clients you have installed. I still like my SDA client better but to each their own.

This is great information and advice. Thanks for sharing and it helped out in a couple of queries I had.

Wish you worked for our IT department! You saved me big time! Thanks

Yes, I did run a virus scan on both the infected drive and the backup. I used the iolo’s System Mechanic, Malwarebytes and SUPERAntiSpyware.

The virus scan found things on the infected drive (files and registry entries related to [random]tssd.exe, asam.exe, syssvc.exe). I found more things in Safe Mode. I removed all the entries. “”AV Security Suite” still came back.

I gave up, and restored from backup.

I then ran a virus scan on the restored backup with the same antivirus programs (System Mechanic, Malwarebytes and SUPERAntiSpyware) and found nothing. I re-scanned in Safe Mode and found nothing.

My question is this: how did I get reinfected? The restored backup was 6 months old and clean. It’s possible my daughter visited a website or did something and reinfected the drive, but she says she didn’t.

Could the infection be residing in a part of the drive that is NOT over-written in a cloning operation?

Thanks.

My ESET NOD32 wouldn’t detect this virus (as it was no doubt preventing it from doing scans). Your step by step guide allowed me to remove it! In less than an hour i was back up and running. People might have a hard time locating the folder that contains the tssd.exe file since it can be named literally anything. Mine had the first 3 letters as “vpn” so it almost looked like a legitimate folder. However once this is renamed, and deleted after reboot, you can get in and clean the rest up. Don’t forget to clean out the registry keys too!

Thanks for all your help.

Thank you very much for the detailed video on how to delete this virus. It was simple to follow and my computer is back to normal! A lot of time and money was saved by watching the tutorial. It is VERY MUCH appreciated; you guys rock.

WOW!!!!!!! It is back AGAIN. Even though I erased the entire harddrive and restored a backup from January 2010 the “AV Security Suite” virus is back.

(And I’m sure the “AV Security Suite” problem only showed up in the last few weeks so I’m reasonably sure it was not present on the January 2010 backup clone).

“Restoring from backup” in my case means using an Acronis True Image cloned drive to restore the infected drive. Acronis deletes the partition on the infected drive (bye bye virus, right?) and then copies the entire cloned backup partition to the “formerly” infected drive.

All was well.

I then searched the drive and the registry for any sign of the “AV Security Suite.” (eg, “xbadiittssd.exe” or anything like that) and I found none.

I also searched the drive and the directory for these suspicious files I had discovered during my attempt to rid the infected drive of the “AV Security Suite” infection:

asam.exe
syssvc.exe

I didn’t find either of those after the “restore from backup” process was complete (but they were definitely on her infected drive).

But now — about a week later — “AV Security Suite” is back!!!

So, one of three things happened:

1) “AV Security Suite” inhabits a boot sector(?) or some other part of the drive that Acronis True Image does NOT erase when deleting a partition prior to restoring from a cloned drive.

2) My daughter did the same thing a second time and got the restored drive re-infected (she swears she was careful, but maybe not careful enough).

3) The backup drive from January got infected immediately upon being attached to the same computer with the infected drive. (I don’t think that is likely because I booted directly from a flash drive to begin the “restore from backup” process and never attached the backup drive to the computer when the computer was running from the infected drive.)

What do you think?

Thanks,
Mike

it worked now i can use the internet and open programs!

This is great information and advice. Thanks for sharing and it helped out in a couple of queries I had.

Hi ty for the video but Im sturggling I used a diffirent guide to remove it and that worked but now it came back and I removed it again but my Virsu softwares say its still there so it will come back soon but I tried this guide and when I went to the file where I have to rename the thing the thing to rename was not there what do I do to get rid of it permantly =(?

OK, I’ll give it on more chance from the (hopefully still clean) 6-month-old backup and take measures to prevent re-infection (assuming my daughter is reinfecting the drive).

BUT, I’m also going to try to completely zero the infected drive before restoring it from backup. The drive is in a netbook (no floppy, no CD drive) so I’m trying to find a disk wiper that can run off a bootable USB flash drive. The netbook will boot off USB, I’m sure of that.

I found this one — http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

It claims to run off a USB drive but I guess you have to make your own bootable USB drive first and then just copy the Secure Erase utility to it and run it from DOS.

Maybe I can find something a little more integrated than that.

I keep trying to change my hidden file settings to show the hidden files, but it won’t apply the setting! It keeps going back to the default setting of not showing them, no matter how many times I click it and apply it. Please help.

You can try booting into safe mode and then attempt the changes.

Also you should still be able to manually access the path by typing it in. While you my not no the exact location you can always copy and paste from the guide to get most of the way there.

They both go hand in hand. the video shows you how to stop this virus and remove it manually. However you still need to run a full scan to ensure you got everything and have no other viruses.

Thanks! I got the virus off, and now can use my computer, but I can’t connect to the internet (I followed the advice about the LAN, but now my LAN doesn’t work at all). When I restart my computer, I now get a Symantic Antivirus message saying TCP/IP not installed. ANy advice? Please help again.

Awesome. What threatened to take hours and / or lots of money on specialists only took 5 minutes after reading this and viewing the video. Thank you so much.

Not sure why your TCP/IP protical was removed. What operating system are you using?

If it’s XP then download a copy of Winsockfix and run that free tool.

Windows Vista and Windows 7: 1. Open up the command line utility and enter:

netsh winsock reset catalog ( Then hit enter )

then

netsh int ip reset reset.log hit ( Then hit enter)

Now reboot and smile because your computer should now be working.

You may also want to reset Internet Explorer.

To remove it permanently you should follow the manual guide step by step. When we say to run a scan with Spyware Doctor with Antivirus you should do so. It will help to identify were the files are at and what exactly you need to delete.

It sounds to me like the security software you are currently using is not good enough to protect your computer. This normally happens when someone is using a free version of security software.

should i download the av removal and follow the vid or just pick one?

I found your page on google *it was thanks to baby jesus I believe! lol* and boy if it helped me remove this darn av virus deal. One of my co-woworkers got it last week and she believes it was by clicking something on page REMOVED LINK ( THANKS) . The porn pop ups started and the AV Suite on the task bar was revealed. It was a pain in the a** but the video helped a lot! I completely forgot to write down what the folder and file was named, but today I encountered another co-worker with the same AV Virus. So I had to do this process once again. I think if somebody gets it again, I’ll become a pro at this, lol!
thanks again! oh, the second co-worker believes it was thru pandora, however, I use pandora and haven’t had an issue….

I had to use the manual removal process to remove this headache from my bf’s computer. I tried the automatic way at least 3 times w/o any luck. It stopped his internet from working once the malware was removed. I followed this advice: Go to IE and then tools. Then Internet options. Click on ‘connections’ tab. Click on ‘LAN settings’. uncheck the ‘proxy server box’, but it still wouldn’t allow me to access the net. My wireless network media status was “disconnected” and I had to uninstall the driver and reinstall it. After that…everything was back to normal. THANK YOU SOOOO MUCH!!! U SAVED US LOTS OF $$$$$!!!!!

Really i can not thank you enough honestly THANK YOU!!!! this really really really helped me i was getting soo unbelievably feed up with that thing! I don’t even know how it got on! i have virus protection and all that good stuff! But really thanks a lot again you really helped me out

oh man , i freaking love you guys this works perfectly ♥

Me too! I watched both videos and Voila! I’m free at last. I’ll share the link and did a digg too. alright! one grateful dude.

Cant say enough about the video! I followed to the directories and found that sucker. Renamed, removed and all is good. I spoke with many “experts” about this prior to stumbling upon your site and it was almost too easy to be true. Thanks a million and I have already and will continue to tell people about your site. I hope you keep it as neat and clean as you have it now!

This guide was RIDICULOUSLY helpful. I was able to easily walk a friend through the the steps using this guide. Thank you for all the help.

What you said will work as long as you are in safe mode. Problem is many people can not go into safe mode because they are blocked. However it’s a 50 / 50 shot and one we do recommend in our guide and video.

As for being done I have to disagree. In most cases those who got infected with this threat got it from a seperate trojan virus. It is very likely to be installed again on their computer if that is the case and they may have many other secondary infections. BE sure to run a full antivirus scan when done just to be sure. We also do not recommend relying solely on free clients because they are simply stripped down versions of a real paid client.

I’ve had this problem before, and I’d always boot in safe mode, do a system restore to a day or two before the incident and then run Malwarebytes. This usually takes care of it for about two months or so… Well this time 2 months just doesn’t seem good enough for me! Before coming to your site, I ran the system restore in safe mode and upon restart was alerted that some files were renamed. It was a file named ‘autochk.exe’ in my sys32 folder that had been triplicated so there were now ‘autochk(2).exe’ and ‘autochk(3).exe’ as well. I jumped the gun and just assumed that if a file had been triplicated within 2 days of normal use (i.e. no program updates or installations) that it must be malignant. So I deleted the files. (Really dumb no-thought decision!) Now, as I’m running Malwarebytes, I stumble upon your site. My only prob is that there is no folder with random characters as specified in my Local Settings\Application Data\ folder. After 2 full scans each of AVG and Malwarebytes, I’m still getting zilch for infections. Am I actually free of this monster?! (I’m given hope in the fact that my internet searches [via Chrome] are no longer being re-directed to ad sites.)

And thanks again SO MUCH for your expertise! You can be assured that you’ll have my FULL recommendation when any of my friends are in need!!!

I have been removing XP Antivirus 2008/2009/2010 and the like for over 4 yrs now and the are pretty easy but this little AV program was a bugger. A friend brought me her laptop and it had it on there since 7/1 @ 4:26pm and it was buggered up pretty bad. I could not run anything (msconfig or regedit or tskman or anything). Once I renamed it it was a piece of cake after that. I usually run AVG (free for home use and Malwarebytes) on all my computer builds and fixes and have yet to have one go bad yet. I hope she doesnt click the wrong thing again. This site and video were right on target. THanks

While in safe mode you will not see the tssd.exe process running. Safe mode only starts the needed process for windows to run. this is a good thing for you. It means you should be able to delete the trace once you find it.

Can you install programs? As stated before please install the Spyware Doctor with Antivirus Client and Malwarebytes. Run the scans and see what it finds.

You may also have luck searching your computer for any file that has tssd.exe in the name. It should pop-up. Then delete that folder

Be sure to re-set the setings in IE or turn off the proxy settings in IE. You can view our manual written guide on this in our how to section.

The main kicker for you is to just find the tssd.exe trace file . keep in mind there will be a name like wesdfsgrt before the tssd.exe file trace.

Worst case I have time to remote in real quick using team viewer if you like. Normally I do not but today is my day off.

Thanks so much. This thing (AV Security Suite) had ‘taken over’my pc Various things I had tried (even in Safe Mode) made no difference … then I found your detailed, easy-to-use guides and really clear videos and was able to delete manually, including Registry keys. Great site – well done.

Thanks so much for showing me how to do this.

This has to be one of the most annoying viruses I had..

Please keep up the good work

God Bless!

OMGGGG THANK YOU GUYS SO MUCH FOR THIS VIDEO I WAS LOSING MY MIND WONDERING HOW THIS VIRUS CAME ON TO MY COMPUTER. IT TOOK ME 4 HRS AND 30 MINS TO FIGURE THIS THING OUT AND I AM FINALLY FINISHED. I JUST DOWNLOADED “SPYWARE DOCTOR” AND IT IS SCANNING MY COMP AS I WRITE THIS. THANK YOU SO MUCH FOR MAKING THIS VIDEO. THANK YOU THANK YOU THANK YOU!!!!!!!!!!

Yours was the only comments that worked and made sense. Thank You Again

Thanks a lot.
Your guidelines helped me to remove it
It is great help
long live you and your service

Hello,

After Preforming every step, I can’t connect to the internet.
The unchecking of the proxy box doesn’t work!

How can I fix this? IE does not work, Firefox, Chrome, Maxthon, nothing! Even Msn can’t connect.

Anyway thanks for this quide! I am able now to use my pc (accept from the internet) now!

Looking forward for a reply!

Jay Jay Kleinendorst, Holland.

If you are talking about the Icon in the notification area on Windows XP, right clicking on that has the same function as left-clicking, and opens up the window to ‘scan’ my computer for threats. This happened the first time I got the AV Security Suite. I followed the video and it seemed I successfully got rid of the virus and all traces of it, but it has already returned and the file is not under the same path. Obviously, the same method cannot be used. I’m not sure what to do now.

I may have friends, but we’re all music geeks so I really didn’t have anyone tech savvy to help me with this. Thank you sooooooooo much! You saved me from bashing my computer with my piano…Or would it be bashing my piano with my computer?

Your instructions were spot ON for manual removal. There were only two lines in the Registry file that didn’t line up exactly however, they were close enough that I deleted them with a net SUCCESS over the project:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “[random]”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “[random]”

in my case it was more like:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion[random]“Run”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion[random]“Run”

In other words, there were random programs letters in these locations that were there from this attack -or- maybe incomplete removal of a previous attack.

Overall, IE seems to be alot speedier.

Thanks SO MUCH !

either switch browsers our watch it on a different computer. You may also be able to simply re-install Adobe flash. We also feature our videos on youtube so you can watch there as well.

The only websites i might have gotten it from was Hotmail, Wetpaint and REMOVED LINK

Thanks man!! What a great free service you provided. Your carma must be stacked on the plus side. Scanning now. I’m using Panda Active Scan. It’s free people. Have a great year.

Once I have removed the virus and am ready to scan my computer for more viruses, is AVG an Antivirus Software that you would trust, or would it be better to go ahead and get Spyware Doctor as well?

I followed your guide to remove AV Security suite (which worked great by the way, Thanks) Virus is gone. But for some reason my internet connection is gone too. Could this be related to AV or the removal process somehow?

Hi there,

I seem to have had this virus, while restarting to try to get to safe mode when booting up it was logging me straight off… and trying a few times it will now not let me boot at all, the system runs but the screen is blank, not a glimpse of any of the function key start up options…

Any ideas what can do? tried my HP resotre disc but nothing happens, drive runs a bit but then thats it….

Help please

First off, I read your guide about 10 times. And the only way to get to your website is for me to start my computer in safe mode. And since i’m in safe mode it won’t let me view the youtube videos, or do ANYTHING. When i’m in safe mode w/networking and I go to processes to stop this virus, I don’t see the “tssd.exe” anywhere. So what do I do?

I am trying to watch the video, but it says the adobeflash plugin has crashed…how am I able to watch the video..is it the same process to remove av security suite with mozialla?

I owe you a beer as well!! m

It worked great for me and looks good so far.

P

Your advice worked like a charm. Took me maybe an hour, can’t say much more but keep up the good work.

Glad everyone is getting help from out guides. Don’t forget to Digg the site and tell your friends. The more back links we can get pointing to our guides and virus removal articles the more people will find the site.

I had the same AV secruity message pop up, and it did change my proxy settings, i kept getting a popup that informed me “file wscvc32.exe has now been activated”…….all this without me okaying or accepting anything…….and i could not open control panel….it started uninstalling programs, yes, i saw a message that said ” now uninstalling avast” and now uninstalling zune, and yahoo chat, and paint, and ect……the icons would disapear after a few seconds…..it would NOT restart nor letme run system restore from any date, so i unplugged and tried to boot in safe mood, but after clicking on the safe mood button it took me to the normal set up anyway….i tried a few more times,all with the same result, then it brought me to a log in screen instead of my main home screen, and demanded my password, i entered it and it said incorrect credentials, i tried a few more times, then i realized it changed my password( i think, i was pretty upset so i might have typed it wrong) at that point, since most of my programs were deleted, i decided f*** it, and i did a full computer nuke, and threw in the backup cd, i wiped the hard drive and reinstalled the operating system (vista bussiness), and that finally got the b*****………it was quick, it sounds a little like this one but a little diffrent, like a changed strain of the same flu…….. i guess it was kinda smart to keep a copy of my operating system eh? but what i really want to know is how on earth did it start, usually the user has to accept something to allow a virus on. i have my computer set to not update without my consent, and it cant store any info from the internet for more than my duration on the site…..id get it, pls advise,
John Wagner

oh yeah sry about the language, but this is the FIRST virus to get the better of me

You guys are great. Thank you very much. I watched the video, followed your instruction and successful removed this virus.

Thank you so much! The video instructions worked perfectly on my first attempt, and I am not tech-savvy. You are literally a life-saver, as I do medical work (urgent clinical test reports, etc.) on this computer, and the virus had shut me down completely. I wonder if it ever occurs to the criminals who design these things that it is not just a game, but actually puts people’s lives at risk!

Thank you. I started windows in SafeMode and followed all your instructions.
It worked flawlessly. Thanks again.

I know you and most people on here can understand how important our CPU’s are and how violated we feel when we are completely taken over by a virus like this!!!! I tried my usual method’s but nothing worked…luckily I have a desktop cpu to have helped me find this site and your video to fix my laptop. Ur the best…and I and we can’t repay you enough….because without your advice, it meant we lost our cpu,spent big money, or had to wipe everything and re-install…..what a pain!!!!!! I luv you!!!!!

It works. The hundred plus thank yous in the comments should tell you that.

you guys saved my life!!!!

Thank you!!

I got it from here:

REMOVED LINK ( THANKS )

I signed up for their newsletter and read a blog (the blonde lady about her trip to ___ – hmmm, I can’t remember).

I inquired this horrible scam through facebook. I was on facebook and everything was fine, the next second AV Security had taken over my computer. I hope this removal works =)

This freaked me out.. all the sudden my computer was acting crazy and not letting me do anything. It freaked me out being that I am on a shared server at work…luckily I found this and after i did the steps it was gone completly. Everything works fine ! You saved my computer ! THANK YOU SOOO MUCH!!

YES! Thank you so much for this guide – it worked and I’m as happy as a trout. Definetly passing along the word to my friends and the Twitterverse.

I used the video and information on your web-site to remove this annoying virus on my personal PC. No problems whatsoever. Now, a co-worker got it and I tried to follow the same steps. However, we can’t find the random .EXE file. We have looked in multiple places and even did this in safe mode. I made sure that Windows is displaying all hidden files. We are using Windows XP. What are we doing wrong that we can’t find the executable that’s running this virus?

I might love you guys! This was so easy and the video made it impossible to screw up. This was my first attempt to fix such a crazy virus so thanks for the help… I thought I was doomed!
<3 removevirus.org!!!
-Merikna

did you run a scan using Spyware Doctor with Antivirus? It should be able to show you the exact file path.

Other then that I would boot into safe mode and search the whole computer for tssd.exe . Also watch the new Youtube video we added into the article. It’s just a link. We remoted in to an XP computer the other day. It may help you out further.

Be sure to report back the file path so we can tell others were else to look.

This is the easiest solution for Security Suite

Guys. I struggled with it a lot. Security suite does not infect any of the existing files. It is a separate application which runs and prevents other applications from running. It gives unnecessary pop ups making you believe that your system is infected with virus. Tried malware bytes and other clean up softwares. Security Suite appears as harmless to virus cleaner becuase it does not infect any files.

Here is how to get rid of Security Suite.

Open Windows explorer and got C:\Users\YourName\AppData\Local. If you are not able to open windows explorer, Go into safe mode and do it.
Find the newest ‘Date modified’ folder(s). Mine were: zsdxcxedw. They looked suspicious and were modified at the same time the virus started. If the Security suite virus started at the same time these folders were created/modified, chances are that’s the virus software. Delete this file and reboot your computer. You are done now.

Thank you for your video and other insturctions. I spent 4 hours last night and about went crazy trying to get this off my cpu. You are a life saver

I trust AVG. The problem is the difference between the free version and paid version. The free version does not protect your computer. It will not block viruses from installing. It’s only after you are infected that it kicks in. Like most free clients out there AVG is just not good enough. However the paid version does offer protection. If you have been happy with them in the past then feel free and make a purchase. However for the money I feel Spyware Doctor with Antivirus is better. A good middle ground would be Malwarebytes.

YOU SAVED MY DAY….

Thanks for putting this page together. This guy is nasty.

I saw the update asking for information on where we we likely got infected. In my case, I’m pretty sure what it was. I was on the Pirate Bay & received a notice that an applet wanted to run with an earlier version of Java. I remember thought “What the heck is running now that wants an earlier version of Java?”, but (stupidly) clicked okay. A few minutes latter AV Security Suite was running amok…

I hate this virus. This site has allowed me to keep a little faith in humanity, so i thank it for that. I have malwarebytes running in safe mode as i type, and commented merely to say i intensely dislike the creator of this and all other viruses. Thank you for helping me keep some sanity.

I don’t know how I contracted it. I was checking out a file in a email, I sent to a friend, which I know was clean. Then the next minute I was bonbarded with pay 50 to get rid of a virus, which seemed more like virus itself. Turned out it was.

Multiple Safemode trips later, I couldn’t find the little bugger.
It was in a local and named something completely different than what you listed and what expected. The only thing that worked was a search for TSSD.Exe

Thanks

Just follow the guide. It works and will remove this threat for you. If it is a different virus other then AV Security Suite you can search this site for the correct virus removal guide to help you remove whatever threat you have. If you have a specific question or can’t perform a specific task in the guide then please ask and we will be able to help.

Thanks millions for the removal guide, it worked and unlike the last time I tried to fix an infection like this, I didn’t have to spend all day on it. I’m pretty sure that I got this from Removed (the new home of what used to be REMOVED). The old site was safe (I’ve been using it for ages with no problems) but apparently the new one isn’t. I hope this helps.

Anna

I acquired the virus from REMOVED

my computer has sum huge virus and every time i start it it a i have 30 viruses. when ever i try to open anything a stop comes and it does not open!!!! i cant download anything either. what do i do?

I LOVE YALL SO MUCH!!!! THANK YOU! IT WORKED LIKE MAGIC AND AM NOW TELLING EVERYONE I KNOW ABOUT YOUR WEBSITE!!

i ran both malwarebytes and spyware doctor accouple of times and they are both giving me diffrent results malwarebytes isnt finding any issues (i am using the free version) and spyware doctor is telling me i still have 80 infenctions on my comp would you mind explaining this? also what registry cleaner do you reccomend i been using CCleaner but it to is giving me conflicting results CCleaner is telling my registry is clean and every prodcut i use is giving me diffrent results 1000, 2000, 500 and i dont think those free fixes are doing a thing which one do i trust?

My work computer system got hit with AV Security Suite. Shut me completely out. You removal video was perfect. Really saved me. Just wanted to say thanks guys

The name is always unique to the computer as the guide states. The only common thing we found was TSSD.Exe in the name.

If the file path was different then what we list for XP Vista or Windows 7 then please tell us what it was so we can let others know about a new file path to look at.

Glad you were able to knock this thing off.

Well, I think I have this thing licked. Thanks! Anyway, you asked for help to find out where this is coming from. My Mom and I both got this today on our computers (in two seperate households). The only things we did the same on the computers were getting the exact same e-mail from a Yahoo group and getting messages via Facebook. The FB messages were sending us replies to comments we posted etc. None of the FB messages were the same. Could either one of these be the “carry” for this virus?

The SDA client and the MBMA client will show different scan results just like any security product would. They are all different and will pick up different traces. Chances are the SDA client is showing cookies as being bad (They aren’t ) however some sites are flagged because of scam issues. The SDA client normally does find more then MBMA and that is why we recommend it over the MBAM client.

As far as registry cleaners they do little in the grand scheme of things. the only time I use one is when I have a known issue and need to re-set some settings. What you are better off getting is a all in one type of tool that helps to manage startup items, defrag, ect. A general PC tuneup tool. Try jv16 powertools. They have a 30 full functional trial and you can fully test it out. I have several licences for them and have fully tested out that program and for a tech guy like me it’s sweet. For a non tech person they may be better off using a more user friendly program. Something like PC Health Advisor. However JV16 is still better it’s just harder to use. You are using these tools more for the all in one settings rather then the registry cleaning.

Thanks for the easy to follow steps to remove this AV suite problem. Thankfully I had Firefox on the computer which allowed me to find your site since my internet connection proxy was changed by the virus preventing me from going anywhere with IE. Another funny thing is that I had the volume turned down on my computer and the virus wouldn’t let me raise the volume. I plugged my earphone jack in to some speakers and cranked up the volume externally so I could hear and follow along. Thanks again!

I have this on my laptop and following instructions to reboot my computer (not from this site) now it won’t boot at all in any mode. I’ve tried Safe Mode, Safe Mode with Networking, etc., etc. In other words, all of the options. I am able to get into the registry editor using a Windows installation disk so am going to try a manual removal from there. My eyes are so tired from reading all of these fixes, (I’ve probably been to 30 websites trying to find help), I was wondering if there is a way to start with a manual removal through the registry that will get my computer to a stage where I can at least get the computer to boot so I can install the removal software. Thank you!

Thanks, this helped me remove the virus the first and second time, however, I would like to note that the program MIGHT not always be %Documents and Settings%\[UserName]\, like for example (on my second infection) it was in LocalService instead of the username box. (I found that out through the companion dog thing)

But anyways, thanks a lot.

If your computer will not boot in any mode then gernaly only an expert will have the tools to get your computer to boot.

However if you have your XP, Vista, Win 7 disc you can do a software system restore. Basically that replaces all the core windows files but leaves intact the programs and files. At least most of the time it does.

You are in the realm of super hard to fix now so re-installing the OS may just be the better way to go. It all depends on what you have on the computer.

Not knowing the error messages on boot you are getting there is no other advice I can offer. We do not generally offer PC repair advice besides virus removal and the like.

I followed the video instructions and successfully removed the virus. Everything was fine about a day, but now I get random tabs opening while I type, and various links I click on redirect to a random site, sometimes redirecting three or four times.

That is not uncommon when you were also infected with a trojan as well as this virus. Re-set your browers and re-set your Windows hosts file. We have a tool for both in the side bar.

Be sure you run a full scan using the Spyware Doctor with Antivirus client if you have not already done so. So many times people come back saying something else happened. It’s because they did not fully follow what the guide says and never ran a scan. If they did they would of found that the hosts file was infected or they had a secondary infection.

excellent, but now my internet explorer (8) is saying i’m not connected to the internet, when i clearly am using firefox. anyone help?!

Asked and answered. Read the guide. watch the proxy video. Read more of the comments.

Yes. You follow the guide and do what it says. Run the scan with Spyware Doctor with Antivirus to locate the infection if your having trouble finding it.

My computer was hit with the AV Security Suite virus and I used your process to delete the virus off my xp computer. Thanks. However, I too am having no internet connection since I removed the virus. I have my pc hard wired to router. The LAN connection says it’s connected – but no packets sent or received. When I try repairing the connection, I get;

‘Windows could not finish repairing the problem because the following action cannot be completed: Failed to query TCP/IP settings of the connection. Cannot proceed.’

Any advice?

Chris

Remove Virus: Excellent Video and instructions! My computer had two of the AV Security Suite files and your video and instructions helped me remove “666″ as I renamed them. Does Microsoft know about you characters? They ought to … outstanding work, please keep it up and Thank You.

Ugh I can’t get rid of it! When I go to the local setting and application data, there is no odd file name! Any suggestions?

I can’t thank you enough. I may be a savvy blogger, but when it comes to things such as this, I’m a bit lost. I’m familiar with the registry files and I was able to remove everything. However, this trojan actually shut off my Firewall. Is that a common occurrence?

The guide and video was right on. Worked perfectly to remove av security suite.

omg. this website…saved 1200$ i bought a good computer. upgraded it, got a av security suite. i have windows 7. I’m llike OMFG NOOO cuz i got this virus last time on my old computer. which was back when there was windows 2000. but i upgraded that one to XP and then this virus….i asked my friend that seemed like a professional to fix it, but instead, he nodded and said”your computers done for. and therefore, i threw it away, kept the monitor tho, and then i got a new computer. which is this one. and then 4 months later. i got av security suite….AGAIN so. this time instead of freaking out and believing that av security suite would help me, i ignored it, stopped the scan thing, and searched for help. Then after 10 searches, i found you! YOU!!!! OMG I REALLY NEED TO THANK YOU, AND I LOVE YOU **** THAT FRGGIN AV SECURITY THING. THIS WEBSITE ROCKS. I’M GOING TO ADVERTISE THIS ON FACEBOOK! =D THANK YOU MY COMPUTER FRIEND.

We at removevirus.org could not ask you for anything better then to tell all your friends about us! Linking back to us is a big help as well. Next time you won’t have to go to 10 sites just to find us.

When I try to boot in Safe Mode, it starts to load and the screen comes up black with Safe Mode in the corners then it just shuts back down. On the way out there is a real quick flash of a blue screen with a bunch of error stuff on it but it doesn’t stay up long enough to read what it says. As far as where I got it, I got a message for an Adobe Update and the next thing I knew I had this monster.

I hate the thought of reinstalling the OS as I just moved everything there from my desktop that has a dying hard drive. I’ll try the System Restore and see if that helps any. Thanks!

I am having the same problem connecting to the internet after I cleaned up from this virus. Outlook runs fine and but no internet. I cannot even connect to the router and I am hard wired to it also. It seams to be a firewall issue, but I cannot figure out what is wrong.

I think I was infected doing an ADOBE FLASH UPDATE. This nasty azz virus took me to porn sites, eryctile dysfunction sites, trying to get me to buy their worthless virus protection. I spent one entire day tryingto get around/rid of it…finally got my laptop up & running to google this AV Security Suite & saw all the people who had been blasted by the rogue program. So glad I can get rid of it myself without another trip to computer store. Thank you for your help!

I LOVE YOU GUYS!! I’ve had 2 frustrating viruses over the pass year and you guys were always there to help me. Thank you removevirus.org!

THANK YOU!!! So much for putting this together, glad I stumbled across it… Wish I knew where the virus came from. You should be annointed for your contributions to virus killing!

All seriousness, I am very grateful for your assistance!

Sweet!! Glad we were able to help you out

I like to removable AV Secutity Suite in the My Coputer…?

Manual removal was the only resolution that worked for me. Your video was perfect and saved me a disc wipe and reinstall.

As would everyone infected with this virus! Follow the guide. It works. If you have a specific question about the guide then ask.

Glad we were able to help you out. Our videos are very sweet!!! To date we now have over 1 million views.

If we were able to help you out then brag about us to your friends. 1000′s of other sites just BS you around. We tell it how it is.

Your advice and understandable video on the “AV Security Suite” was perfect…Honestly, you saved me $200 I was ready to spend at the Geek Squad. That approach would have cost me 2-3 days without a computer as well. THANK YOU SO MUCH!

The fact that you have been infected DOZENS of times with this threat is just proof that those FREE programs don’t do anything to protect your computer.

We do recommend users installing Malwarebytes and running that program as a secondary precaution and to help remove this threat. However you should still run Spyware Doctor with Antivirus to ensure you have removed all threats. While the scan is free this program will not remove threats unless you make a purchase. However you are still shown the exact traces that need to be deleted so it’s a great solution to use even if you do not plan on making a purchase. For protection so you do not get infected again, it is our top choice for a security client.

HijackThis is good stuff but it’s not user friendly and if you do not know what you are doing you will cause more harm then good. I personally use it all the time. However users are better off watching our proxy removal video or reading the guide.

I had the same issue. Go to IE and then tools. Then Internet options. Click on ‘connections’ tab. Click on ‘LAN settings’. uncheck the ‘proxy server box’.
Worked for me. good luck

absolute GOLD …… THANKYOU!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Hello,

I did exactly the same thing as yours but when I get to renaming part… After I rename it, it doesn’t have that image, mine has ‘x’ on it and I can’t seem to delete it. It would say

“Cannot delete blah: Access is denied”
“Make sure the disk is not full or write-protected and that the file is not currently in use”

What seems to be the problem?
Please help!

The process on my computer showed up as “jaksuyr”. just FYI. Also, as it was previously commented, it has gotten smarter. I had to use a combination of Spyware Doctor and Malware SEVERAL times in order to get it taken care of. I had to restart in safemode to download. After a while I couldn’t even do that so I logged in under the guest account and ran the Spyware doctor there. The Guest account ran much quicker and the SD caught a lot more stuff. I then logged back in to the Admin account and ran it again and again got even more viral goodness. This has to be run several times. In my experience the PC Tools Spyware Doctor did much better than Malwarebites (still a good free program though). Unfortunately, I had to pay for the SD but heres a helpful hint: download it, then go to uninstall it and it will offer 60 days full protection for $5.99. Good luck…AV Security Suite is a nasty little effer.

You did not follow the guide! You need to first stop the process before you can delete it. It’s great that you re-named it. now re-boot your computer like we said in the video and you will be able to delete it.

to save you other troubles. BE sure to run a full security scan to find the other viruses and any other traces from this threat.

I’m not a computer wiz, by any standard, but was able to clear this obnoxious virus off of my computer. I still have no idea where it came from. I hadn’t clicked on anything strange, hadn’t opened an email or an attachment or visited a suspicious site, but somehow managed to get it anyway. Running AVG now and haven’t found anything, so hopefully it is gone. Thanks for saving me time and money!!

Two free programs can easily get rid of all traces of this crap. My computer has been infected with the “Security Suite” scam dozens of times now. Simple fix. I run Malwarebytes in safe mode. It finds and removes every trace of that nonsense but will not restore my internet connection. I reboot and run HijackThis to find and remove the proxy server “Security Suite” places on my computer. Both programs are free and it only takes me 9 minutes to get rid of that garbage.

The above works. It’s exactly what we already tell you to do in the guide.

Ok, i followed all steps to get rid of the suit thing. But i still have zero connectivity at all. I really dont know how to get my internet back and now this stupid suite thing has ruined or i think ruined 2 computers im on a different laptop than the others. So Basically the av securtiy suite is gone but i still have no internet please help me i am willing to donate 10$ U.S.D Paypal to the site or anybody who can help, Thanks for your time and consideration

Golden advice. I see you are a soccer fan.

thanks for the updated trace. I would also recommend you attempt the update and scan under safe mode with networking. You can learn how to boot into safe mode under our How to Guides

I am not sure if the bottom two registry keys are valid or not. I do not make assumptions in the registry. The best thing to to is download Spyware Doctor with Antivirus and run a full scan to see if it detects them. If it does not I really would not worry about them. You may also want to run a full scan with Malwarebytes.

I would personally scan with both.

I am trying to remove this per your instructions, but I find no processes to stop with tssd on them. Also when I look at the Apps/Local there is no file with tssd. Do they always have this in the name? I know my computer is infected with this. When I turn off the proxy settings in internet tools I still can’t get to any websites. were do I go from here?
Thanks

Saved you 200 bucks and 2-3 days with out a computer. I think you owe me a beer!!

Glad we could help you out Mike.

Seems like AV security suite hit me harder than most of the people here.. i can’t even get my computer to start on original mode. it only tells me on a blue screen that there is a problem or something and then it restarts itself. i can only start my computer in safe mode with networking. I don’t know what to do! and all those HKEY files… more than half of them doesn’t even excist on my computer! i don’t know what to do. AND I REFUSE TO PAY ANYTHING! I’ll rather go buy a MAC… i’m way too bad at computers to handle EDIT like these viruses. may the people who did AV security suite burn in EDIT.

I would LOVE some help but right now it seems like my computer is a Sisyphean task… Nothing but meaningless.

I went to a couple of different sites trying to get this stupid thing off. I couldn’t get it to go away! And I didn’t want to pay for SpyDoc. The manual removal worked wonders! The other sites only got rid of the registry keys, but not the application, which re-installed the keys. ARRGH! Really, you’re a lifesaver. Thanks!

–One Relieved IT Guy

No cursing or foul language is allowed on this site. We all have the same feeling but offensive and hate language will be removed. Most comments even minor like the above just get deleted because I do not have time to edit or moderate.

” I refuse to pay anything” This type of thinking is what gets people in trouble in the first place. If you do not pay for a good security client you will be infected again and will go through all of this again and again. Free clients are worth the price you pay. While many are good they offer no support and little real time protection. In most cases they are stripped down versions of the full program.

With all that said here is what I would do only because your computer will not boot in normal mode.

1. Boot into safe mode and run a system restore. Go back two weeks.

2. Re-boot normal and see if your computer boots up fine. It most likely will. Now Delete your old re-store points and create a new one after that.

Now download and run Spyware Doctor wtih Antivirus and Malwarebytes. Follow the manual guide using the data you collect from these programs.

Report back if un-successful.

The TSSD Process has been in the AV Security Suite virus in all of our testings. This however does not mean things have not changed.

What Operating system are you using? I’m assuming Vista or Windows 7 because of the folder path you gave.

Do you have any funky looking folders in the below directory?

* %YOUR USER NAME%\AppData\Local\[random characters ]\

Are you able to boot into safe mode with Networking and download and run a full scan with Spyware doctor with Antivirus as instructed in the guide? In most cases this will show you the actual file names and paths to those files that need to be deleted.

If you are tech savvy you can have a look in the startup menu and see if any weirdly named file are in there. I believe we cover this in the video already.

Sounds like you are getting there. You may have a root kit. While it does cost money for the SDA client you should at least download it and run a scan. From the results you should be able to find the other traces that are re-installing this and then manually delete them.

Did you follow the proxy removal instruction in the guide? we also have it under the How to Guides section. You may also need to re-set the Windows hosts file if you that is infected. You can read that guide to determine if it is infected.

You may also need to reset the Winsoc settings. We also have a guide for that there as well.

The manual removal was perfect for me as well. Despite several attempts to run anti-malware software AV kept hanging on–I almost respect its tenacity. Thanks a ton, one time through the manual process got it done.

Thanks for the awesome video and instructions for removing this virus. It worked but when I was removing some of the registry keys I could not find them. See below for the list. I did find all the others. I have anoter question at the bottom.
•HKEY_CURRENT_USERSoftwareavsoft
HKEY_LOCAL_MACHINESOFTWAREavsoft

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “[random]”
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “[random]”

I did find a file that was:
HKEY_CURRENT_USERSoftwareavsolution
HKEY_LOCAL_MACHINESOFTWAREavsolution
Should these be removed too. They have the AV infront of solution.
Thanks again for helping.

how do I find the files on vista?

You simply follow the guide above. We list the paths to the threat.

Ok i’ll do that! Just one question : “now delete your old re-store points and create a new one after that” I don’t really understand what and where to do this! I have tried to make a system restore and it said that it couldn’t complete the restoration. I tried several times on different dates. I’m so grateful that you take your time and help me! (and i’m sorry for cursing but i’ve tried to fix this for 3 days..)

Thanks for helping get rid of my security suite. I was able to do it all manually just using your video, which was easy to use I didn’t get confused or lost someplace in my computer.

Your tutorial was great help to me!! thx!

I actually did run several scans on my computer after removing AV SS, but like you said the AVG software was the free version, so that may have been the problem.

Okay, I found the page to reset my hosts file and got that fixed up, but I don’t see a link to a guide on resetting my Firefox browser settings. Or does the ‘RE-set Internet Explorer’ link also fix the problem for a Firefox user?

Thanks for your help.

PS, I was browsing websites a few days ago and ran across Yahoo Answers, which linked here: Link Removed
I downloaded that program and ran it and it completely deleted AV Security Suite from my computer. However, I can’t be sure if it was linked in some way to the tabs that are randomly opening.

They did not end in Tsdd.exe because most likely you have Security Suite and not AV Security Suite. If it ended in something like shwd.exe then I am correct in saying this.

The Security Suite threat just came out so almost all clients are unable to pick it up just yet. That is why we pump out these manua