Antivirus Security Pro is a program that should improve the security of your device
Antivirus Security Pro is a rogue anti-spyware, which belongs to WinWebSec. This program looks just like other threats that also hail from this group of rogue AV applications. However, the new thing about it is that it comes with a digitally-signed installer, which should ensure the trustworthiness of the program.
Most likely, it is misused by malicious people or the ones who want to profit from gullible people. Once Antivirus Security Pro gets inside the system, it starts its activity by showing misleading notifications that typically announce about dangerous viruses. Note that it warns its victims only about invented infections or legitimate files that should never be eliminated.
That's why you can clearly ignore this application and remove it from the system. If you are interested what's the real purpose of its bogus alerts, the answer is really simple – it is designed to create a need for its licensed version. Definitely, you should never purchase it on purpose since Antivirus Security Pro full version is doing nothing positive on the system.
Researchers always note that you need to consider Antivirus Security Pro intrusive since it makes various changes to settings on your device and affects time on the machine significantly. More gullible people install the promoted application and suffer more damage.
Some of the fake warning alerts might display:
Warning! Infected file detected. Suspicious activity detected in application setup.exe similar to behavior of the virus Win32/Conficker.X For your security and to avoid loss of data, the operation of application setup.exe has been temporary restricted. To reset the application's full operation, you must use the full edition of Antivirus Security Pro. Recommended: You are using a limited version of Antivirus Security Pro. Please activate Antivirus Security Pro to resist all virus threats efficiently.
Antivirus Security Pro – Threats found when scanning, to keep your computer safe, repair is required
Antivirus Security Pro – Warning! Suspicious activity detected. To keep your computer safe, the threat must be blocked
If your PC is infected with Antivirus Security Pro, you should immediately download and run a full system scan with an anti-malware tool that is reputable. Don't forget to download the latest versions of these programs in order to have a full virus database.
You should react to those false warnings out of nowhere and avoid any interaction with the site entirely or the program pop-ups. This way you can avoid difficult Antivirus Security Pro termination procedures in the future. As for the damage on the system folders- run FortectIntego and fix those affected files.
Ways that PUP developers use to spread their rogue applications
Antivirus Security Pro is spread by other programs or on sites that can show false messages about exploitable security vulnerabilities. It attacks poorly protected systems, so, if you want to avoid its infiltration, you have to make sure that your machine is protected with the latest version of antivirus. Still, if this PUP manages to get inside the system, it secretly downloads files that belong to the virus, so it is difficult to find all the pieces and remove them.
Please, ignore every alert that belongs to Antivirus Security Pro because this program seeks the only thing – to get your money. As soon as you start seeing alerts that belong to this rogue, you should run a full system scan with updated anti-spyware. Also, remember that the program might install other apps automatically.
Antivirus Security Pro termination tips and tricks
Note that there are many rogues that block legitimate security applications for preventing their elimination. In this case, you should stop malicious processes that belong to the rogue app by finding them in Task Manager. This way you may also find a particular place where Antivirus Security Pro is installed and remove it.
Look for exe processes, stop them, and run a full system scan with anti-malware then. Don't forget to scan your device with a PC repair tool after Antivirus Security Pro removal to recover the functions.
Uninstall from Windows
Uninstall from Windows 10/8:
- Type Control Panel into the Windows search box and open the result.
- Under Programs, select Uninstall a program.
Uninstall from Windows 7/XP:
- Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
Remove the unwanted program:
- In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
- If User Account Control appears, click Yes to confirm, then complete the removal.
Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Reset Internet Explorer
Remove dangerous add-ons:
- Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
- Pick Manage Add-ons.
- You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.
Change your homepage if it was altered:
- Open IE and click on the Gear icon.
- Select Internet Options.
- In the General tab, delete the Home page address and replace it by your preferred one (for example, Google.com).
- Click Apply and then select OK.
Delete temporary files:
- Press on the Gear icon and select Internet Options.
- Under Browsing history, click Delete...
- Select relevant fields and press Delete.
Reset Internet Explorer:
- Click on Gear icon > Internet options and select Advanced tab.
- Select Reset.
- In the new window, check Delete personal settings and select Reset.
Remove from Microsoft Edge
Delete unwanted extensions from MS Edge:
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click Remove.
Clear cookies and other browser data:
- Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
- Under Clear browsing data, pick Choose what to clear.
- Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.
Restore new tab and homepage settings:
- Click the menu icon and choose Settings.
- Then find On startup section.
- Click Remove next to any suspicious startup page.
Reset MS Edge if the above steps did not work:
- Press on Ctrl + Shift + Esc to open Task Manager.
- Click on More details arrow at the bottom of the window.
- Select Details tab.
- Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.
Instructions for Chromium-based Edge
Delete extensions from MS Edge (Chromium):
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.
Clear cache and site data:
- Click on Menu and go to Settings.
- Select Privacy, search and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.
Reset Chromium-based MS Edge:
- Click on Menu and select Settings.
- On the left side, pick Reset settings.
- Select Restore settings to their default values.
- Confirm with Reset.
- This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Did this guide help?
11 comments
Ed Oliver
I was attempting to clean a coworkers personal computer which had been infected with this program. My personal first step doing this is to run Malwarebytes, as you recommend. As his computer could not access the internet I was installing Malwarebytes from a USB drive However, Antivirus Security Pro has apparently been "improved" and would not even allow the installer to run, claiming to have blocked a malicious program that destroys files. Also block Vipre Internet Security installer. And, at least on this machine, it automatically shut down windows as soon as it got to the desktop when booting into safe mode with networking (tried 3 times, same result every time). Finally tried RKill, and had to use three of the name variants of that, as the first two I tried were also blocked. When one finally run, though, it worked. Installed Malwarebytes, found and removed a bunch of stuff with it, including this one, then installed and ran Vipre which got rid of a couple more.
Luis
Hello, I have discovered additional routes and keys (Windows 7):
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun (contains the random value)
HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonuserinit (reset to: C:Windowssystem32userinit.exe,)
HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftDirect3DMostRecentApplicationName (set it blank)
glynn
Maybe you should say it will cost to use this program
ROB
i was fooled by an email. i figured it got in the junk mail by accident. it as saying i had a voice message on whatsapp which i made an account but never use it. it came in .exe form and the icon was a .wav icon. idk what malwarebytes does truefully because it didnt pick it up so i ran it and here i am infected. luckily i have another laptop and blank dvds to try and remove it. right now i am using a bootable windows defender dvd i downloaded off Microsofts site. it booted and started a "quick scan" which didnt find anything. i am now running a full scan and its saying it might have found something harmful on the hard drive.
also with this threat you cant boot into safemode.however you could fool the virus and download another task manager and name it something like explorer.exe and from what i read it should allow it to open and then you kill the process install your removal software and you should be good to go.
John
It seems theyve made another improvement. Not only ca you NOT go into safe mode but RKILL shows everything as OK. RKILL runs when named iexplore.exe but finds nothing amiss.
Sabrina
Ive encountered the same as Rob and John and am still unsuccessful in removing this beast of a virus. Any suggestions how to get it off again?
Malwarebytes did find the virus, and supposedly delete it but when I started up my computer again after removal of files, nothing had changed and the virus ran first. I am unable to start my computer in any type of safe mode, the virus overrides that possibility, forcing a restart in normal mode.
So how can I get this virus off on my own or do I have to pay the professionals to do it for me?
Rob M.
I encountered the same thing as Rob and John. I saw my particular bad file was llrnhg6a.exe.manifest plus 5 others with the llrnhg6a name. I did a search to see where they were. C:Docs & SettingsAll UsersAppDatallrnhg6a. When I tried to go through command prompt, it just gave me C:Docs & SettingsOwner. It couldnt find it. So I unhid files like it said to do here. Did an explore on App Data file. Right clicked and tried to delete whichever it let me which was 2 of the 6 bad files. Then I right clicked on the .exe file (I think) and started Malware...make sure you update Malware before you start this removal. Now, this thing wont let Malware launch so you have to go into All Programs, scroll over Malware until you find the Chameleon feature. Start this...I had to go to #5 before Malware launched. After an hour, it found 15 infections...restarted...ran FULL scan again for an hour...3 infections...ran FULL scan again...0 infections. FINALLY!! I tried to find any more of the llrnhg6a in Explore App Data...there was an llrnhg6a file there but it was empty but I right clicked on it anyway and permanently deleted it with Webroot...which wasnt able to do that prior to the FULL Malware scan. MalwareBytes/Chameleon ROCKS...I might actually have to pay for Malware now since my Webroot failed me BIG TIME!! Good Luck
xDrewX
This a nasty wee infection, ultimately easily removed though, naive programming. Moderator does not permit bad language or threats but I know what I’d like to say and do to virus writers......
Many access tools are disabled by the virus, anti-virus, ‘Safe Mode’ also. Windows Explorer still functions though, turn on view hidden, system etc files. Shortcuts on the desktop obligingly reveal where the main ingredients lurk, in this case C:ProgramDatagaDrXnns. The nasty files cannot be removed or renamed because ‘In Use’. Also lurking is a batch file which reboots the system if Safe Mode is attempted. It can be renamed but is regenerated. Didn’t occur to me but perhaps altering the contents whilst leaving the file size unaltered (and maybe setting the date if you have the utility) would fool the process. Try that first.
‘Restore’ was disabled but easily switched back on, C:windowssystem32rstrui.exe. Restore points hadn’t been deleted, virus writers are unimaginative, ignorant and stooopid. Once restored to the day before infection, the directory (folder) can be removed. Then a deep boot scan (thanks Avast) followed by fragment clean up (and thanks CCleaner). Internet connection is reqd for anti-virus installations, Avast anyway, but after the main malware ingredients are removed download was fine. Best to remove other anti-virus before installing Avast (or your chosen one) because they tend to throw hissy fits at each other. Norton, even AVG, but especially McAfee which has been known to target other anti-virus as malware. Upshot is crawling performance, failed installation and sometimes BSOD. Actually it’s more difficult eradicating some anti-virus progs than this virus.
If the virus progresses beyond this primitive level one could insert a batch file to kill and delete the Safe Mode disabler, I didn’t have to resort to that. One could also boot from a boot disk (lots of freebies available) and eradicate the active ingredients from there prior to full disinfection. You have to alter the BIOS of course to boot first from CD.
It’s much easier working on an infected machine if you can run alongside a clean machine for research. Incidentally this instance was on Win7 Home Edition. XP restore is different, disabling restore (I think) deletes restore points, different exe file too so one could try altering the .bat file contents first or use a boot disk to access the malware files if that fails.
Be of good heart, it may look hideous but it’s not difficult to remove and it doesn’t seem to generate collateral damage. Flashy but badly written by persons of paltry skill and intellect. If you are reasonably competent with Windows interstices you won’t have trouble getting rid of it. Takes a few hours doing it’s thing -- while watching Dr Who at the same time. If you are not comfortable there are screeds of people who could do it for you, just ask around, your local school if there are competent kids, much cheaper than High Street outlets.
Aubree
Do what the instructions say, but reboot in safe mode first.
(Shutdown, restart, then hold F8 while computer reboots until screen loads, then scroll down to safe mode with networking.)
Jim
The first thing I try when attacking a virus is to download a "free trial" of a reputable Antivirus to a clean computer and burn it to a CD-R. Then I install the downloaded file on the infected system.
c kuhns
Download roguekiller on a different computer
copy to usb drive
boot in normal mode
run cmd in administrator mode
find roguekiller on usb drive, rename it to iexplore.exe
run iexplore
scan and cure
other antimalwares will now run.