Remove Antispyware Soft | With Video!

right click on the Antivirus soft icon on your desktop and go to properties. Copy and paste that path into Windows Explorer to open the path. Then re-name your file trace.

This is all shown in the video.

Extraordinary piece of work. No need to buy any software. Just follow the steps manually. You can get rid of Antispyware soft very easily

Please keep in mind that if you do not have a security client you will get re-infected again with something else. So yes you really do need a security client however you do not need one to actually remove this virus.

Also if you have a security client be sure to update it and run a full scan to ensure no other viruses are installed on the computer. Millions of computers are infected and the owners have no ideas.

Thanks for the great advice. This was a huge help.

Thanks You soo much it’s not on there no more, But whats this registry keys?

THANK U SO MUCH. ITS RIGHT THING TO DO……….

Thanks for the thanks.

If anyone has a working url to download this virus for testing please post it. We are wanting to make a removal video for this threat but now having troubles getting infected again with this threat.

This worked for me. Restart, before loading up tap F8. Safe mode with networking. From here follow the above. THX!

Before I manually edit my registry, I want to understand exactly what to do for line itmes like this:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″

When I look at the entry on my registry, I don’t see the = “1″. Am I supposed to delete this “RunInvalidSignatures” entry? Or change it to “1″. What is the significance of the “=”?

You are better off not messing around in the registry. This is more for a pro who fully understands what they are doing.

I would recommend you run a full scan using a legit security client. This will at least show you what keys needed to be deleted.

This information was so helpful.

Other tips: The rogue software was blocking taskmgr.exe, so that I couldn’t kill the process. I kept pressing CTRL-SHIFT-ESC until I was finally able to click on and kill the process. Used start –> run –> regedit to remove the registries.

You should run a virus scan.

Most likely your hosts file has been changed. I recommend you reset IE and your Hosts file. The needed tools are in the side bar.

Followed steps and removed virus. Now I can’t reconnect to internet. Anybody have any recommendations?

I run Spybot S&D and AVG 10 and they still didn’t catch it.

After you’ve followed these steps I also recommend that you set a System Restore checkpoint when you are SURE the system is back to where you need it.

Alternately you can use a know good System Restore point from a prior time if you have qualms about editing the registry

Thanks to your instructions and your video, I was able to successfully get my Windows 7 computer back to normal. The Antispyware Soft trojan\virus wouldn’t allow me to use Task Manager (or most any other program). I was able to use Firefox (my default browser) without any problems to access your website.

I simply followed your video instructions as well as having a hardcopy of your instructions.

I did have to use IE8 to correct my LAN settings…. I had to do this in order for Yahoo Instant Messenger and WeatherBug to connect to the internet as Antispyware Soft changed the settings.

Thanks again for your invaluable information\video on this subject!

thank you norton anti virus anti spyware for doing absolutely nothing to stop this stupid thing from getting on my computer. thanks for the guide to removing it. thank god i have 2 pc’s side by side so i could look this up on the other one.

i deleted all the files adn the stuff it put on my registry, but i still cant run my internet explorer or other online programs such as messenger

what should i do?
thanks

Ok, I’m not the smartest gal in the world, but your video guide was EXTREMELY helpful! I was panicking until i ran across your site. Instructions were simple and in less than 10 min I was able to get rid of this nuisance! (Best of all I didn’t have to ask my boyfriend for help! >=] ) It works, thanks so much!

((I was a little nervous when it came to picking out the right folder in which I had to rename the file inside, but after looking over the names of the other folders I had, one just didn’t seem to fit so I went with my gut and it worked =D ))

If the scan detects this as an infected file I would delete it.

Followed the above steps for XP Pro and cleaned my Reg. and can maneuver
through my programs. When I scan sysem I still show
C:\windows\system32\Kernel32.dll infected, any suggestions.
Thanks for all the help thus far, so close can taste it.

Beauty instructions, mate! It kept popping up warnings during the registry editing and wouldn’t permit the deletion of the executable file. So, I rebooted in SAFE mode with a command prompt, and deleted it manually. Reboot, while holding breath, all’s well! Thanks again!

Just an FYI on this comment. While running a system restore may work we normally do not advocate it in our removal guides.

The reason for this is so many viruses and trojans infect your system restore points. If you go this route and it works then that is great. However don’t stop there. ENSURE you run a full virus scan. You already know we like Spyware Doctor without Antivirus above all else so run a scan with that just to be safe.

Your issue has nothing to do with our guide but proves that your system is not fully normal.

did you already download the SDA client that we recommend?

Some other suggestions

1. Ensure your network is working
2. Re-set your hosts file
3. Re-set your Winsock settings

In most cases real security software can repair most the damage already done but if you have not installed anything that is why you got infected in the first place.

We do have a Hosts reset tool in the side bar that you can use as well.

I had to fully remove all the registry files connected to the virus, as well as the virus itself, and then I was able to connect to the internet.Also I had Symantac antivirus and it did not protect me. I got Kaspersky before I was able to find this site and now I am running it. Thanks for all your help!!!!!!!!!

Very helpful. Especially since my computer could not access the internet and download an antivirus program.

Great help. Thanks again.

Great Find! I double checked an infected system and this is 100% accurate.

Guide will be updated to reflect this.

Hi
Think I had the same problem. It was the proxy server setting, the virus sets it as using a proxy server so you cant download a solution (apart from thier scam). Try turning the proxy server off at LAN settings on the conections tab of Internet Options.
Hope this helps
John

confirmed, the virus checked this box to stop me from getting on the internet. i followed your tip john, and now i can go online after following the guide as well.

-windows xp running internet explorer 8

thanks guys

So some new information. I’ve had this happen to a friend of mine before and had to go the whole nine to clean it up. I managed to catch it, BUT was able to kill it without having to restart into safe mode- I was able to access the internet via Firefox- they have their own built in proxy settings unlike IE and Chrome, which share the same Windows Internet Settings function that the virus attacks.

So anyhow, I tried using rkill.exe- and only mildly successful. Then I managed to download and run (you have to name every file you run to Iexplore.exe since the AVSoft allows it to run). I was able to then run a Process explorer (I used Sysinternals) since task manager was disabled, and shut down two processes that were running (the major one being ######tssd.exe). Then got everything back online and mostly fixed without having to restart.

Anyhow thought, I’d share with you here some other locations I found registry keys (if you know what you’re doing, you should double check and run a search for Avsoft, AVsuite, Avscan, and tssd- odds are, you’ll find something, and I did. I have a 64 bit Windows 7 System and I found it in

HKEY_CLASSES_ROOT\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\AVsoft (and AVscan)

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\######tssd_RASAPI32

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\######tssd_RASMANCS

Anyhow, back up your registry if you do anything.

Thanks for helping to update the guide. Your work will be included in the master guide.

After spending my time fighting this virus cursing the people who write such vile things, I must say now I’m cheering people like you who figure out how to get rid of them. Thanks!

I have Windows 7 and I set my files to show hidden folders. When i tried to find the appdata folder it wasn’t there. I also checked in program data and other folders and it was not in those either. Also, when i open the task manager in safe mode, none of the processes that are shown above are there. But i definitely have the virus.

Please help me out!

Thank you so so much!!!!

You are Most Welcome. Glad we were able to help.

Be sure to tell your friends.

it wont let me delete it due to the fact that it says i need permission to do that action

Most people who get permission errors get it because they are in the wrong directory. If you are using Windows 7 or Vista you need to be in the %User%\AppData\Local\[random characters ]\ folder.

I bet you were following the XP path which will give you the permission error.

Ensure you have admin privileges. Most likely this is not the reason for the error but could be if you are using an account that is limited.

this helped a lot, our desktop got infected. I use my own laptop so you can kinda tell who was using it (non computer ppl, oh idk!) But this step by step helped a lot.

While looking for HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\######tssd_RASMANCS, I found HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMAN. I’m on vista. Are these the same? Should I delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMAN? I read on the McAfee website that the trojan virus changed this file, but they dont say what to do about it…other than to purchase a McAfee product. Otherwise, thanks guys! This was a HUGE help! I have Norton 360 and it didn’t detect any of this!

PS- When looking for HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″, I only saw “RunInvalidSignatures” 0×00000001 (1) . Are they the same? Should I delete it?

Again, thanks a MILLZ!

Help.. I cannot find the Documents and Settings folder in my computer

FOLLOW THE GUIDE!!!!!!!!!!!! You have Vista or Windows 7. You will not have a Documents and settings folder. Use the Vista and Windows 7 file paths shown above.

i removed all the files on the guide. and i removed all of the rogue HKEYs that i could find, but my internet wont let me download anti-virus software. i turned of the proxy, but when i click on the recommended anti-virus, it gives me an error page or never loads at all

Sounds like the Windows Hosts file is infected.

Download the Re-set Host files tool in our side bar. Or else read http://www.removevirus.org/how-to-guides/how-to-reset-hosts-file-xp-vista-windows-7

If this does not work for you report back.

It worked like a charm and resolved issue compeletely. Thanks a lot…..

Once I renamed the file, rebooted the computer, and deleted the file, I went to find “%User%\AppData\Local\[random characters ]\[random characters]tssd.exe”. However, that does not exist. Does that mean I do not have to worry anymore?

No it does not. You need to scan your computer using a real security client to ensure no other threats are installed.

To be 100% clear: There is NO directory called %User%\AppData\Local\[random characters ]\[random characters]tssd.exe

The “\[random characters ]\[random characters]” is just that. random characters that will be 100% unique to your computer. You have these file paths for sure if you were infected. you just need to find out what the names are for your installation. That is were security software can help out.

Windows Vista/7:

* %User%\AppData\Local\[random characters ]\[random characters]tssd.exe

I copied this from the above article. Yes we do list the paths in the video as well. My guess is you are skipping steps. Read the above article for more detailed info. The guide works.

We also detail in the video on how you can find the path yourself.

I have Vista Home Premium, which does not have documents and files, so what do I do?

i had spyware doctor with anti virus on my computer and still got antispyware soft,, spyware doctor never picked up the virus and so i dont understand why everyone insits that spyware doctor can remove the virus..i uninstalled spyware doctor from my computer and as soon as i restarted my computer was acting better..i still have some of the virus left and cant get rid of it.. i have stopped the process in my startup menu so at least it wont run but is still there..its called utjfactssd.. i have tried so many things to try to manually remove it but nothing seems to be working..none of the registry keys are the same either,, i just dont know wat to do now..

Chances are you never did the free upgrade to the 2010 client or you did not have the security client updated with the latest traces. Every security client needs to be kept up to date.

Many warning come up when this thing tries to install and in 100% of our testing the current SDA client blocked this threat. However as with any security client nothing can stop 100% of all threats. That is why you should take advantage of the free support from PCtools and have them help you remove the threat if you are having issues.

The SDA client worked 100% of the time to remove this virus from our test computers. It’s one of the best security suits out there and that is why everyone is recommending it. The problem most people have is simply stopping the running process first so they can then install the security client.

Worst case have http://www.onlinecomputerrepair.org remove the virus for you.

thank u for ur reply, i had the latest up to date version of spyware doctor and updates were current,,i think the virus is hidden so well in my system that i cant find it,, guess i will have to seek professional help,, thank u for ur reply and concern..

oh and i forgot to mention i contacted pc tools thru their email support and all they told me was to run an update and scan again,,which of course didnt help,,again thank u for ur time..

Do exactly what they say and report it back to them. If the client does not catch anything they will then move you up to the next line of support. They want to help you out because if it’s a newer strain they need to know this stuff so they can make additional updates to the client.

Hi, I watched the video and followed all the instructions for removal.I restarted my computer and got an error message: “windows explorer has encountered a problem and needs to close”. Is there a way to fix this? Or did I do something wrong?

This error may of been the result of the virus. However this site is focused on virus issues only and not other related PC errors. I would ask this question over at http://www.techguy.org

With that said I’m still going to give you an answer. After you get the error open up the task manager. Select the FILE tab then NEW. Type in Explorer.exe to re-start the process. In many cases doing this once ends up solving the issue. Not all the time but it’s quick to try.

I second everything you just said. I have Norton and could not BELIEVE it said my computer was “normal” NOT! I had to buy another computer (hence I found this absolute GENIUS that walked me through removing that nasty infector).

THANK YOU!! You are an answer to prayer!

I totally feel like a computer genius, but I know it was all you. Thank you, thank you, thank you. You just saved the computer I need for school from a horrible attack by Antivirus Soft. The video was a great help too!

Gina !

Just want to say many thanks for the excellent video and step by step instructions! I have bookmarked your site (not that we really wanna go through that again!). We couldn’t get on the internet at first, but read through the notes people had left, and your responses, and it appears that everything’s up and running okay again.

Again, thank you very much for helping the e-community! You need an S on your chest

Thanks for the kind words. I do hope you never have to visit our site again but we are here if you need us.

i cant find the random character file in my window 7 pc.
i follow all the steps but when i get to to locate that file its not there. all the files have real names not some random characters.