Security Suite

We are more then happy to try to help you out.

Boot into safe mode with networking.

Login as admin. Try to do a system restore first. go back 7 days. This tends to help people working in XP more then anything else.

Then boot normal once the restore is done. See if the infection is still there. If it is not popping up great. I highly recommend you donwload the 30 day trial of Spyware doctor with Antivirus and run a full scan. While the free version will not remove threats it will show you the folder and file locations.

You should also run a full scan with Malwarebytes to double ensure you have no threats left over.

Try this route first. If it does not work report back and we will take it from there.

Thanks guys I have finnaly been able to remove “Security Suite”.

As Carl said earlier I also found the WNXMAL folder instead of the AVSS.

The Only problem I still have after removing “Security Suite” is that my icons right under in my taskbar are gone. You can see there is a space for my usual icons but it only shows a gray bar. The weird thing is, if I move over the grau bar I still get to see names and can still rightclick stuff.

The instructions worked great. The only difference I found was that the registry entry was name WNXMAL instead of AVSS but it contained all of the same bogus info shown in your video. This was on my father-in-laws (85 years old) computer which he uses mainly to play online checkers.

Thanks Carl for letting us know it worked for you. We are also going to add to the guide based on your feedback.

I have win xp professional
i get it listed in task manager
but task manager does not show path to any of its files listed

also …..

it does not allow me to set folder options
i could do this if i reboot in safe mode, and login as administrator
but even them “Romero” is the administrator

when i navigate to the path you specified
it will NOT let me in to the user/romero
as if the folder was protected

i cannot afford to pay for virus removbal
im on disability income

but would appreciate any tip[s or help
from this forum

God bless you all in advance

thanks

ps: im familiar wit all the terminologies used in the forum
so please do not think i will not understand instructions,
i can follow along pretty well .. thanks – please help

Ensure the SDA client is fully up to date. Yes it does normally pick up all traces and that’s why we love the program. My guess is once you check for updates it will pick everything up.

Your proxy settings are being set back because the threat is not yet gone from the computer. You can boot into safe mode with networking and change the proxy settings there as well as run the SDA scan and update the client.

Try to manually remove the Security tool executable. I do not know your OS so you will have to follow the guide to go to the correct path.

you may also want to try a system restore. Go back about 7 days. This seems to be working rather well at undoing what the virus has done. You will still need to to run the full scan afterwards to ensure you are clean.

My other computer is currently infected with Security Suite. I was able to open up Spyware Doctor immediately after reboot (the same way you mentioned opening Task Manager in the video). Ran a full system scan and found nothing (which surprised me–Spyware Doctor usually finds everything, in my experience). Then tried to reset “uncheck” the proxy server in IE “Tools”/LAN settings in order to download a fix, but it keeps defaulting back to “checked” and displays the IE “Diagnose…” page, even after reboot. Any suggestions?

My girlfriend and i got worried, mostly because i got the virus on her new 2000 dollar computer, but thanks to level headed`ness and of course your AWESOME webpage it was easily remedied.
The easiest way i found to get rid of it (on windows XP) was bringing up taskmanager and ending the program. Afterwards, it was as easy as running an antivirus software and deleting the program and all registry problems. AVG found all the virus, and the registry problems.
Thank you so much for your information, and keep up the astounding work guys and gals!

Your Welcome glad we were able to help. Keep in mind that the free version of AVG does not offer protection against threats. It will stop zero viruses from infected your computer in the future. It’s better to have the paid version of AVG if you are a fan of them. As you know we already recommend a different security client but if your happy with what you have there is no big reason to change except for upgrading to the paid client.

I did as you suggested also but the one difference i found was that the reg string

HKEY_LOCAL_MACHINE\SOFTWARE\WNXMAL ( May have this instead of the above AVSS trace. You will still have the same 32+ files in this section )

was on my system as

HKEY_CURRENT_USER\SOFTWARE\WNXMAL ( May have this instead of the above AVSS trace. You will still have the same 32+ files in this section )

Just wanted to pass this along…

I consider myself a relatively experienced computer user – but I’m stuck in the user folder (even with hidden files shown, after the local settings>application data>user) and there’s no folder with a funky eleven letter name. The only ones that seem suspicious is a folder named “WMTools Download files” and a “configuration settings” file named “DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF”. would any of these be it? please help! thanks

We did not find it in the Application Data/User folder. It should be in the Application Data folder on XP.

Open the WMTOOLs folder and see what is in there. If it’s a bunch of giberish .exes then yes that is the one.

You may have better luck booting into safe mode with networking and installing Spyware Docotr with Antivirus and run a full scan. This will show you the exact folder path of the file you need to delete.

I’ll try it in Safe Mode. Also, is there a “How to” on the system restore (I should probably know this stuff . . . but I don’t)?

I was successful in locating the file (gqqfiyfshdw). However, I can’t end the process at all. Task manager is blocked by the virus, as well as Command prompt -__-” Do you have any ideas? I’m stuck.

We will add that to the list of articles to make in the future. However there are already thousands of articles online relating to how to do a system restore. Just google System restore and your OS and you will find some of the guides. It’s rather simple

Just boot into safe mode and delete the trace if you are having troubles doing it in safe mode.

Is it really a must to delete the files from Application Data (Vista)?

I also have this virus now, and I deleted the files in the regedit, but if there are any files in de App Data which are supposed to be deleted, I have a problem I think.
A while ago somehow all my files were deleted, long story, but I had to “un-delete” them and since then I wasnt able to open “Local Settings” “Application Data” and other maps like that.

Currently Im in Safe Mode running a Full Scan, but this is the third time Im doing this. The first time after I deleted the files in regedit, though.

I hope its not neccesary to delete the files in App Data?!

I NEED HELP!PLEASE! MY COMPUTER IS DEALING WITH A BAD VIRUS I TRIED YOU VIDEO ABOUT THE ANTI VIRUS SOFTWARE I COULDENT FIND IT THE FOLDERS! PLEASE HELP MY COMPUTER IS INFECTED AND I KNOW ITS A SCAM ISANT THIS ILEGAL PLEASE HELP HOW DO I GET RID OF IT!

i used system restore before i found this website and now there are no popups but theres a problem when i try to go on my homepage it goes to this wierd page that says that i cant go to this webpage anymore but when i type an website to another in the address bar it goes there but then i checked my homepage tab and saw the internet explorer cannot display the website and when i removed it and set up a different website windows defender said that some changes were made and when i go on my homepage the same internet explorer cannot display the page also it has a circle with 4 different colors split in forths

thank you sooooo much- i was so frustrated~~

My computer got infected by security suite and I’ve been working on deleting it but when I run my computer in safe mode with networking or just regular mode I get a message stating:” Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now.” and then after a minute the computer restarts. And then it does it all over again…
Do you know if this is from security suite or now do I have another problem?
Thanks

This is not caused by security suite however it is a virus that is causing this issue. With out knowing the exact name of the threat or operating system you have it will be hard for us to help.

With that said if your computer is not shut down in normal mode you should be able to bring up the task manager right away after first loggin on and attempt to terminate the running process. Also you may be able to access the startup files on your computer by typing in MSCONFIG into the run box and then under the Start-Up tab you can uncheck startup files that look suspicoius. This may help you to be able to download Spyware Docotor with Antivirus and run a full scan. Alternatively you should also download Malwarebytes and run a scan with that program as well.

Glad we could help. Tell your friends.

You ask for help but provide us with no information to help you. What is the operating system you are using. What have you tired in our guide? What is the exact step you are trying to do that you can not do?

We know the guide works and it has been used by others thousands of times to remove this threat. We are all for helping you but you have to help us help you by providing more details on what exactly you have tried and what you could not do.

Because you have Vista you will not have access to the folders you mentioned. They are simply mapped traces and will contain nothing of value.

You do need to remove the file or files in the AppData folder( It’s a different folder then you showed) that is shown in the guide. You must be following the XP file path and not the Vista / Windows 7 file path.

What is the scanner you are using? As stated we recommend Spyware Doctor with Antivirus and running a scan with Malwarebytes is a very good idea as well. Try them both and see if it does not detect the exact file locations for you.

Best of luck.

What browser are you using? That will determine the course of action that is needed. I would recommend you try the default things, re-setting the browser, attempt a re-isntall, update it to the latest version.

Sounds like a reg key may be set to over ride what you have preset in there. You may also want to check the Windows Hosts file. We have guides on all of the above in the How to guides section. At least I think we do.

Kaspersky is good stuff and should get the job done just fine. Update the client before you run a full scan. Also if it picks nothing up be sure to run another full scan in another day or so after you update.

If your still very curious I would recommend you running a scan using Malwarebytes. The SDA client we recommend is what we recommend people purchase and use. However Kaspersky is still a very good client. The free malwarebytes version can be added and used once a month as a backup scan for Kaspersky.

Thank you so much for this page, you seem to have saved many people’s lives!

I didn’t see this guide before I used System Restore on XP. It appears to have cleared up the immediate problem but of course the virus is probably still present. I use Kaspersky (premium) and was wondering if this would remove the problem, or if I should download Spyware Doctor or something as well…

Thanks again

Apologies if I accidentally double posted

thanks for the awesomely clear instructions. Successfully removed and on my way again.

Thanks to an I-phone with google and your instructions and the videos, I was up and running again very fast.
Videos are a little hard to see clearly in safe mode but you can stop them and follow instructions and start them again, until the tasks are finished.
Thanks again.

Did you go to the folder path shown in the guide?
What is the exact path you are looking in?
Did you unhide hidden files and folders?
Did you boot into safe mode with networking and install Spyware Doctor with Antivirus and run a full scan?

The above should all help you find the threat. report back if the SDA scan does not pick the exact folder and files were this threat is stored.

alternatively you can read the comment a few above yours about going into the msconfig and startup section and locating the file that way.

Great that you are able to stop it. You can also right click on it next time in the task manager and SELECT file location to view the path were it is at. Please report back the FULL path if it is different then in the guide.

I am amusing you have vista or windows 7. I say this because you used the AppData term. Be sure you are looking in the correct folder as described in the guide / video.

It is not un-common for users to not be able to change the unhide system files and folders. You can still manually type them in

C:\Users\YourUSERNAME\AppData\Local

Safe mode may no longer be working because of the virus. Often times going into safe mode and doing a system restore actually can do far more harm then good when viruses are involved.

Try all the above. also be sure to run a full scan with Spyware Doctor with Antivirus. the stuff works great at finding this threat and will also tell you the exact path to were it is located. You should be able to install it once you stop the shwd.exe process from running.

The proxy setting is all that you have to change to have internet access.

Spyware doctor with Antivirus when fully updated does work to pick up this trace in most cases. I would encourage you to simply ensure you are updated and then run the full scan again.

You should disable all other security clients when you run a full scan with the SDA client. Those others will only interfere. While SDA does cost money for the client to remove threats you can run the scan to see were all the files are located. I have a sneaking suspition that it’s not fully updated because of the problems that you mentioned earlier.

You should also follow the manual guide and look in the locations that we have provided.

Lastly if you see the icon still in the task bar it tells me it’s still there. You can go to the windows start button and in the run/search box type in MSCONFIG. Under the startup tab you will see a list of programs that start when you computer starts. Uncheck the box that says shwd.exe and then manually browse to the location path given there and delete the file.

because you are already trying other security products you might as well run a full scan with malwarebytes. That is our second favorite client. Just note that free clients do nothing or little to protect your computer.

Okay well…I believe I did something really stupid.

I got this Virus a couple of days ago, now I of course panicked but didn’t give into buying the product thing (Because I’m not young enough to have a Credit Card yet) and so I went to my sister for help once it didn’t let me back on the Internet.

She tried everything but we both didn’t think about using her computer to look for information.

But my FireFox worked fine (I had downloaded it before that had happen so I’m kind of thinking that might have given me the Sercuity Suite).

So I tried looking for some info. on that, I heard that Spyware Doctor would work, so I downloaded that. But when I did it wouldn’t work for a while (Until I updated it by using the link from this page).

But anyways since it didn’t worked I used Spy Sweeper. And I restarted my computer. And then the Security Suite wasn’t there anymore but it still wouldn’t let me use Internet Explore (Once again I wished that I’ve seen this video before).

But then I reinstalled Internet Explore then it worked fine.

But then my Trend Mirco AntiVirus would pop up and say that I either have a ‘Low’ or ‘High’ Risk rating, the High one from Internet Settings.

But not only that each time I would turn my computer on I would see the Security Suite icon on the Right hand side of my Task Bar but each time I move my mouse towards it, it would disappear.

Now I’m scared that I can’t remove it properly and fear that it will mess up my computer.

I was able to stop the process in the task manager ending in shwd.exe, but im not able to find the offending folder in user > local settings > appdata, nor in user > appdata, all the folders have normal names and no unusual folders or exe files inside them. i was running both avast and ad aware and they have yet to detect the files.
i thought i had hidden files visible but i went to double check and when i opened the control panel something called “drwatson postmortem debugger” crashed and froze my computer. i tried rebooting into safe mode but i cant even do that. when i select safe mode lines of text referring to system32 appear on the screen and its frozen there.

When I highlight the shwd.exe on the windows task manager i can’t find the location of the file. I have XP and I recently restore my pc to a week before and it stop popping up. I scan it with malwarebyte and found some threats and deleted them but the security suite came back two days later. I open the Application Data folder but i cant find the file. Every time i try to restore my pc the process fails. What can I do to find the file?

A repair at this time is going to be hard. Chances are your computer may already have an image on it. Dell HP, Sony, Emachines, Gateway ect… They all include factory images on the computer. Some times it will fully restore the computer to factory mode. However others do sometimes provide options like deleting everything but keep all your personal folders, documents, videos, music. I would advice you to look for your manufacturer and model number and see if it holds an image and look around for how to access the image.

ahh sorry for forgetting to mention i was using xp. i guess i said appdata because thats how they referredto it in the video. i think its application data but i cant really check to be sure and unfortunately cant test those methods because i can no longer boot the computer in safe mode or any other mode, period. it freezes instantly after selecting which mode to boot in (or when picking safe mode loads up to a file ending in config/system.log) is there no hope for me at this point? i cant find any solutions to this online other than booting from a windows xp cd which i dont have, or burning an iso onto a cd which i have no access to any other computer.. (posting from my iphone)

Well earlier this afternoon I had restarted my computer and quickly went to the Video on how to remove it. And in note of that the other one that my computer had caught (The one I couldn’t remember) was a shdw.exe

I was able to get it off, but as of right now (I’m not sure later in the future, but so far it looks good) that the Spyware Doctor had said it must reboot to stop (Or I think it was block) other infections.

And so far nothing bad has happen, I really thank you very much for all the helpful tips you had given out.

Thanks for the great advice, had the virus out in no time! I’ve used your site before and it’s always been of great help. Thanks again and keep up the great work

When i try to open the taskmanager, it says that taskmng.exe is infected, what should i do?

-Thanks:D

Ive gotten This specific virus so many times, it is practically a weekly task for me, easy to remove now though, I use search and destroy to clean my registry

It will say that when you open just about any program. That is the nature of the virus.

what should you do?

Follow the guide. It works. If you have a question on a specific step we would be more then happy to help.

Sounds like you don’t have active protection to stop the virus from infected your computer. I’m willing to bet all the security clients you are using are free ones. That is why you keep getting infected. That or P2P sites.

I found your website after searching for “computer virus security suite”. It’s very informative. Thank you! Apparently, I have the virus that is described on your website. Not only am I getting pop ups continually, but, it is starting up internet explorer with the web address showing the following: Domains Removed, etc. Very annoying! It doesn’t show anything probably because the virus won’t allow me to go online. I guess that is a good thing considering the addresses that it is automatically adding! Anyway, I am doing a full scan using the Norton Software. It is now 43% complete and so far it has not found any viruses. However, I am getting very impatient. Should I pause the scan and follow your instructions on your video or should I continue with the scan and then work with the video? I appreciate your help!

All comments go through moderation that is why yours did not show right away.

You might as well finish the scan. I bet Norton does not fully pickup this threat. When it fails just follow our guide and it will help you out.

I finished the full scan and Norton picked up nothing. I went ahead and followed the instructions on the video. I found two folders with weird names as you described but both folders were empty. I went ahead and deleted them. It did not seem to do anything. Suggestions? And, thank you for your response…I really appreciate it!

What is your operating system?

What is the exact folder path you found those folders in?

Are you able to open the Task Manager and identify the malicious process? Hint. As soon as you log into your computer you should be able to bring up the taskmanager right away before this virus starts up. then you will be able to right click on the process identified in the guide and click Open File Location. Then you can go ahead and stop the process and delete the file.

Please note we recommend all people to run a Full scan with Spyware Doctor with Antivirus because it is known to pickup the security suite virus. You may need to boot into safe mode with networking to install and run the scan. This program will also tell you the exact folder location were this threat is at.

In adition to all of the above you can also find out the needed folder by tying MSCONFIG into the run command. From there go into the startup tab and find the malisious file from the manual guide. Uncheck the box so the program does not start when you boot up your computer. In that section you will also be shown the registry key that needs to be deleted and the folder path to the executable that needs to be delted. Write it all down ( IT should already be in the guide) and re-boot your computer then delete the needed files.

My father accidentally put the Security Suite virus on his computer, but thanks to your instructions, I was able to successfully remove it. I can’t thank you enough.

If the problem remains that means your not getting the core of the infection. Most likely a trojan or rootkit is reinstalling the virus on you.

Try to un-install the SDA client. Re-boot. Go into safe mode with networking and run the install again and update the client and run a full scan. Based off the scan you can then manually remove the needed items that it finds.

If the client fails to update after the re-installation then I would re-set the windows hosts file. We have a guide for this under the How to Guides section.

Normally once the process is started for a factory restore all your data is wiped. This virus is not able to interfer with the factory restore process so you may have a secondary issue going on as well. I would suggest you attempt a system restore before trying to do a factory restore. That is if it’s not too late and you corrupted the operating system by trying it already.

Your site is awesome, but everything I try leads me nowhere. I have tried running Malware Bytes and Spyware Doctor. Malware Bytes will run and give me a list of things to remove, but when I reboot in normal mode, the problem remains. I can’t open Spyware Doctor because it says it needs to be updated…which the virus wont allow for. I’ve tried doing a straight restore to factory settings too but the program just stalls out.

Unfortunately, the thieves at Best Buy want me to pay $200 to have it fixed. I need serious help!

None of the stuff mentioned here showed up in the task manager and I had no local settings folder when I went to rename the files. I hope that’s enough description.

The full path is already in the guide. Follow the path outlined in the guide for your operating system.

In our initial testings Mcafee did not stop this threat. However it’s been out long enough that it should now be able to pick it up. I personaly do not like their software and highly recommend you run a scan with Spyware Docotor with Antivirus to help identify the traces.

Would McAfee’s virus removal be effective in stopping security suite and could you give me a full folder route on stopping the process at the beginning because task manager doesn’t work and i haven’t got a clue what the process’ name is…

thanks in advance

I’m so glad I found this website to remove this Security Suite fake security client….phew!!!! Thank you very much. I wasnt able to view the from this site, but I went on YouTube to do so!!! THANK YOU SO MUCH!!!!!

Thank you so much for your clear instructions – this was simple to follow and removed the virus from my computer. Thanks once again

That’s a lot of information .

1. chrome share the same settings as IE so yes your .wu extention if blocked on one will be blocked on the other. Most likely a hosts file issue. Re-set the Windows Hosts file.

2. You are still infected. Most likely with a root kit that will not be easy to remove. Run a Full scan using the SDA client and remove the threats that it finds manually.

3. I would recommend you learn how to use Highjackthis. Most people do not need to but in your case you better run that program as well. that should help you identify the virus files and remove them.

Be sure not to log into any bank accounts or social websites till you get this issue resolved. Normally people who are infected with the Security Suite virus will not have as bad of secondary infections as you but it does happen and you got the short end of the stick.

Worst case ( Backup your data first) Run Combofix.exe. Google it. It should do the trick but can also cause more harm then good. It’s a great program for those who just can’t get anything else to work. Be sure to run that SDA scan first however.

(In the following post, please replace all instances of “wu” with the obvious operating system update… virus is preventing me from submitting this post with that string…)

Last week my desktop became infected with Security Suite, making the computer unusable. I booted in safe mode and ran malwarebytes, which seemed to remove most of the problem and make the computer usable again.

However, running the scan a few times, I kept getting us?rinit.exe popping up as an infected file. I figured that malwarebytes was having troubles removing that file because of the wild card character, so I removed it manually.

I then rand malwarebytes and stopzilla a couple of times until they both came back clean (other viruses like alureon.h, renox.lx, gen_nullo, etc. kept showing up)

I also had to change my DNS settings to access the internet (a virus must have changed my DNS to use a proxy, and the antivirus software apparently just turned it into a blank proxy).

So, after all that the computer seems to work OK, but there is clearly a problem.

1. Something is blocking all access to “wu.” This is weird, and does not appear to be a DNS thing. If I type in any web address with the string wuin it, I immediately get an error saying the connection was reset and the web page cannot load. This not only blocks the wu page, but anything with that string. For example, if I google wu, then the google results are blocked because the search string is in the url. If I type in something like cnn.com/wu, it gets blocked (versus typing in something like cnn.com/junk which gets returned as page not found.) I have no idea which process is blocking the access, and it is blocked in all browsers (ie, chrome, firefox). This prevents me from running wu(I realize I haven’t updated windows in a while, and may be missing key security patches). (Aside from wu, I can access any website, including anti-virus ones)

2. The other thing I notice is immediately after starting a web brower, I am getting hundreds of ad ware cookies. This doesn’t prevent using the computer, but I assume there is some kind of infection.

3. I have noticed if I run internet explorer (I typically run chrome), I am getting random popups.

I have also run the following programs:
trojan remover
superantispyware (free edition)
webroot antivirus with spy sweeper

I’ve tried running anti-virus software in both safe and normal modes.

Usually running the software cleans one or two stray malware files, and then returns clean results for a while, but wu is still blocked, indicating the virus is not eradicated. Then, after using the computer for a while, later scans indicate new viruses, so I am guessing I have some kind of hidden virus that is downloading other infections…

Any idea of what could be causing this? The Security Suite virus was what seemed to set all of this off, but I haven’t found any other comments about wu being blocked, so I am thinking I may have a different virus as well.

I have not downloaded spyware doctor, but I will try that next. (I have been downloading updated virus definitions for the 4 programs I am running and have been running continuous scans, which often take 2-3 hours, so trying each new program is slow…)

Oh, and I should add that I also have a laptop using the same router. I can access the wu page with my laptop, indicating that the problem is not on the router, but somewhere on the desktop.

I would recommend you go into safe mode with networking and ensure that you turn off hidden files and folders. It may just pop-up then.

If not you should download and install both the MBAM client and Spyware Doctor with Antivirus. run the clients and see what they locate and were the traces are. This route should work for you.

my son picked up this virus and his computer was buggered but after watching your video i got it and removed the sucker

A BIG Thankyou

Hi,

Thanks for the helpful site.

I am not sure if i have a new strain of the virus but it is still operational when i boot up in safe mode therefore i can not open task manager to stop the operation or remove the proxy settings for IE.

As a consequence, deleting the file in the Apps Data has no impact.

Many thanks for your help in advance.

Regards

Many thanks for help in removing Security Suite. Much appreciated.

Delete it as per this page:

open the task manager as the computer loads i managed to open it before the virus opened the security suite component

so upon your account opening press crtl+alt+del and it should open

hope this helps

So I’m pretty sure I have either AV or Security Suite, but the problem is I can’t log into my computer. I am able to access the computer in safe mode but when I search in the app data/local folder, no inappropriate files can be found. Any suggestions or ideas? Desp need of help! Thank you!!

In the off chance that your safe mode has been defeated (like mine) you can download a program called rkill. If you can do it quick enough the minute you log on run it and it will terminate the rouge program and you can do wat ever you want. It just takes some timing.

So I’ve tried to enter safe mode with networking but it won’t allow me to, I can enter normal safe mode though. It keeps saying my activation period is expired and to restart my computer in normal mode to activate windows. When I boot the computer in normal mood, it asks me to verify my vista product key code. I can tell its the virus because the screens keep flickering if i press cancel. I downloaded both MBAM and Spyware Doctor and tried to run them in safe mode. MBAM said nothing was there but the problem is Spyware doctor says it needs to update but I can’t connect to the internet. Any suggestions?

So you are able to access the internet in Normal mode and download products? In safe mode you can not do this unless you can enter into safe mode with networking. Because you stated you could not I will assume that is the case.

I would try to run a system restore. Boot into safe mode and start the restore process. Go back about two weeks and see if that does not help to resolve your issues. Then boot normal and re-install the SDA client and run a full scan.

Option 2: Use the Vista restore disc and do a soft restore from the disc. A software restore does not override user settings or files but reloads the core OS. However in-experienced users sometimes hit the wrong options and end up wiping the drive. go with the first option and let us know the results.

You may also be able to bring up the task manager right after logging into windows. The second you put in your password start trying to open the task manager. ctrl+shift+del

Be sure to read both the removal guides because you are unsure which threat you have on your computer. Knowing what file to kill right away will help. You should first right click on the file and hit Open file path then terminate the file. Now you are in the needed directory to simply delete the file. Hopefully now you can update the SDA client and see what other files you need to manually delete.

Sorry for the confusion. I downloaded the programs on another computer and used a flash drive to transfer them over in safe mode. Tried the system restore but no luck. Also tried to open the task manager but it just continued to ask me for the vista product key. Looks like I need to go find my restore disc and give that a shot. I will update as soon as something happens so just in case other people are experiencing the same problem

My wife picked up this virus on her laptop from a horoscope email….
She is running xp with firefox. I followed the instructions here and had no problem with eliminating the virus. The one thing I found different was the file name, it did not end with *shwd. Just random letters. After I changed the name of the file, deleted, rebooted and ran malwarebytes. Malwarebytes cleaned up the registry.
Thank-you so much for all the info….

Sounds like a plan.

You may also have luck doing these two things.

1. In safe mode type “msconfig” with out the quotes into the run / search bar. Just click the Windows icon on the bottom left and enter the msconfig there.

This will bring up a dialog box. Select the startup tab. You will see all the programs that are auto starting on your computer. Uncheck anything that looks very suspicious. If it has a weird file name or matches this guide you need to un-check it. Now take note were those files are and their registry location. Click OK and do not reboot yet. If the virus traces are in there and you no it is a virus then delete those files or at the very least re-name them.

Now re-boot normal and see if you can’t follow the rest of the guide.

2. Install highjackthis in safe mode and run the program. Pay close attention to 004 section. Highjackthis is a powerful tool but does require advnaced computer knowledge. Most people find it too hard to use. However there are forums out there with people who do check these logs for you and help you determine what needs to be removed. You may find this program to help get things under control so you can at least run a virus scan.

Yhea I try to blame the misses for things and it does not work. Glad our guide was able to help you out. Ensure you have live upfront protection in the future so this does not happen again.

thank you so much for the help with removing the virus. my sister hit the thing when she was online or downloading a torrent and once my Norton expired this thing flared up fast. i didnt have to restart the machine after renaming the file i just simply logged off and logged back on simply because my machine takes an ungodly amount of time to load on startup. but thanks for the help i ran a full registry scan to fix any registry keys that were corrupted or left empty and my computer is now running without this virus. =)

Mcafee still does not detect this threat at all. Malwarebytes dioes not detect all the virus files either. If you have Mcafee (as I do) you will need to follow the instructions and manually delete the virus files described above. I did this and it seems to have worked.

Thank you!!! I have a Dell pc with Windows XP and Mcafee security but my son thought this looked safe when it came knocking and allowed it access. It looked like all hell broke loose or so it seemed. I don`t have 2 pcs but i found your site on the pc at work and followed your instructions. All I had to do was system restore back 7 days and it was gone. I haven`t tried the more technical stuff `cause it sounds a might intimidating. I`ll have to read thru all of the instructions and watch your video (something i can`t do at work). Thanks again you saved me lots of $$$

^—–that comment above suggests me that I can remove the virus by just doing the system restore. Is that really true? I’m not completely sure what a system restore is. But I guess that makes sense. Should I follow the steps you provided or should I just do a system restore?

I recommend not using the system resotore as it can cause more harm then good when infected with a virus. However if you already have backups of your data it’s a great and simple way to go.

Essentially system restore is just sending your computer back to a configuration it had on a certain date before you started having problems. When infected with a virus such as this it will in most cases uninstall the false security client and many of your issues will be resolved.

Downsides: The down side to this is the virus makers have caught onto this simple repair method and often times the restore points themselves are infected. When you try to do the restore it will sometimes corrupt the operating system. Personally in my testings this has not happened on this specific threat. However you should be aware of the risks and the potential loss of data.

I would first follow the guide and see if you can’t kill it off. If it gets too frustrating or you just can’t seem to get it working then try the system restore approach. Just know that there are risks involved.

I’d totally have your kids.
Thank you so much! You’re amazing, your tutorial was the only one that worked.
Unfortunately, as soon as I removed security-suite, the virus evolved like a pokemon and turned into Antimalware Doctor. However, you also have a tutorial for that (that means I have to thank you twice). I’m still missing the last step, but I’ll get Spyware Doctor with antivirus as soon as I get my paycheck.
Once again, thank you so much!

<3

Not on top at all but I’ll answer anyways.

For free options you have CCleaner. When you go to install it the program will auto check a box that you have to uncheck other wise it will install other software on your computer like a tool bar. Very common with free tools.

JV16 Power Tools has a fully functional 30 day trial. More details on this client at http://www.registrycleanersreviewed.com/jv16-power-tools-review.html

Regsitry Cleaners: In most cases registry cleaners will not resolve blue screens or speed up your computer. can they? Yes. Will they? Most likely not. It is a great way of just keeping the registry clean and repairing damage from a virus by setting things back to default. however ALWAYS make a backup of the registry first. You will also get more use out of all-in-One regsitry cleaners that allow you to do other things beside just registry cleaning. Things that include a defrag, startup manager, temp file cleaner and the like.

hey any free registry cleaners that you can recommend

my trial for jv16 has expired i just want to keep my registry clean so that junk does not pile up

I like this article, harvesting is also great, Thank you for sharing.