If You Need Expert Help we recommend you hire a Ninja! Ninja's are well trained in the art of virus removal and can remove all threats from your computer right now. See this Description: Earth AV is a rogue anti-malware application that attempts to trick users into making license purchases. It is related to the well-known rogue software Green AV , Eco Antivirus and Earth AV. Earth AV installs itself on user systems through Trojans that get downloaded when the user attempts to download Flash player codec packs, and from fake security websites which exploit vulnerabilities in the system's security to get downloaded and installed without the user's knowledge. Once installed, Earth AV immediately loads up as a Windows service, and proceeds to perform an endless number of fake security scans on the system. As a result of these fake scans, Earth AV will report that there are viruses present on the system which are not really there. It will also generate fake security pop-ups from the Windows Taskbar, trying to convince the user that the system is infected.
The aim of all this activity is to push the user into purchasing the license for the 'full' version of Earth AV under the pretext that the currently installed 'trial' version is incapable of performing the cleanup activities needed to save the system. However, you should remember that the viruses that Earth AV detected didn't exist in the first place, and therefore you should never pay for the license of such a fake application.
Earth AV
» Download Earth AV Removal Software
The first thing you should do as soon as you find a copy of this malware on your computer is initiate Earth AV removal. In order to delete Earth AV, it is important to stop processes, unregister all malicious DLLs, delete files and folders and remove registry entries.
Automatic Earth AV Removal
Online Earth AV Removal Service
Earth AV Manual Removal Procedures
The first step you need to take in order to remove Earth AV is to stop the following processes:
- ergui.exe
- ErV_paid.exe
- eav.exe
- msdl.exe
- vec.exe
Next, it is necessary to unregister the following DLL files:
- ergui.exe
- ErV_paid.exe
- eav.exe
- msdl.exe
- vec.exe
The next step in Earth AV removal is to delete the following files and folders:
Windows XP:
- %Documents and Settings%All UsersStart MenuProgramsEarth AV
- %Documents and Settings%All UsersDesktopEarth AV.lnk
- %Documents and Settings%All UsersApplication DataEarth AV
- c:Documents and SettingsAll UsersApplication Dataeav
- c:Documents and SettingsAll UsersApplication DataeavBase.dat
- c:Documents and SettingsAll UsersApplication Dataeavmsdl.exe
- c:Documents and SettingsAll UsersApplication Dataeavmsll.exe
- c:Documents and SettingsAll UsersApplication Dataeavvec.exe
- c:Documents and SettingsAll UsersApplication DataMicrosoftMachine
- c:Documents and SettingsAll UsersApplication DataMicrosoftMachineWStech.dll
- c:Documents and SettingsAll UsersStart MenuPrograms Earth AV
- c:Documents and SettingsAll UsersDesktop Earth AV .lnk
- %APPDATA%mozillafirefoxprofiles\gsl.dll
- ergui.exe
- ErV_paid.exe
Windows Vista/Windows 7:
- %Documents and Settings%All UsersStart MenuProgramsEarth AV
- %Documents and Settings%All UsersDesktopEarth AV.lnk
- %Documents and Settings%All UsersApplication DataEarth AV
- %USER%AppDataeav
- %USER%AppDataeavBase.dat
- %USER%AppDataeavmsdl.exe
- %USER%AppDatamsll.exe
- %USER%AppDataavvec.exe
- %USER%AppDataMicrosoftMachine
- %USER%AppDataMicrosoftMachineWStech.dll
- %USER%AppDataStart MenuPrograms Earth AV
- c:Documents and SettingsAll UsersDesktop Earth AV .lnk
- %APPDATA%mozillafirefoxprofiles\gsl.dll
- ergui.exe
- ErV_paid.exe
After the above steps have been completed, Earth AV no longer exists on your hard disk. While taking the necessary steps to ensure the fact that no other malicious softweare resides on the PC it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.
If you find this threat too hard to remove yourself and need an expert we recommend www.pcninja.com . They charge far less than others and are great at what they do.
Earth AV Registry Removal Procedures
In order to properly remove Earth AV it is necessary to delete files, folders and registry keys related to this rogue software product. One of the most complicated aspects of this set of tasks is the proper removal of all registry keys that are part of this malicious product. In order to properly remove Earth AV, the following keys will need to be deleted:
- HKEY_CURRENT_USERSoftwareEarth AV
- HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun “Earth AV”
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallEarth AV
- HKEY_CURRENT_USERSoftwareEAV
- HKEY_CLASSES_ROOTAppID{29256442-2C14-48CA-B756-3EE0F8BDC774}
- HKEY_CLASSES_ROOTAppIDWStech.DLL
- HKEY_CLASSES_ROOTCLSID{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
- HKEY_CLASSES_ROOTInterface{051C9A06-FB08-486F-B09B-8B33B261637D}
- HKEY_CLASSES_ROOTTypeLib{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
- HKEY_CLASSES_ROOTWStech.WStechB
- HKEY_CLASSES_ROOTWStech.WStechB.1
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
- HKEY_LOCAL_MACHINESYSTEMControlSet002ControlClass{4D36E96E-E325-11CE-BFC1-08002BE10318}S
- HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun "mxcll"
Earth AV Directories:
- Vista and Windows 7 Users: %USER%AppData eav
- XP Users: c:Documents and SettingsAll UsersApplication Dataeav
Conclusion
While attempting to remove Earth AV manually certain technical complications may appear. In order to limit the number of possible problems that may appear after a manual removal attempt it is recommended to use the online removal service provided by www.pcninja.com or to scan the entire computer using Spyware Doctor with Antivirus in order to properly identify any other remaining malicious components.
Related Article Keywords: Earth AV, Remove Earth AV, Earth AV Removal, How to Remove Earth AV
See our Antivirus Software Reviews for other security clients that we like.
As always please post updates to the file traces. If yours are different then other users will find it helpful. If you need futher support pleas just ask your questions. We are glad to try and help you out.
