VirusBurst and VirusBursters Removal Guide

Table of contents.
Why do you need to get rid of VirusBurst / VirusBursters?
What installs VirusBurst / VirusBursters without your knowledge and consent?
Are you infected?
Automatic removal of the VirusBurst / VirusBursters trojan
Manual removal of the VirusBurst / VirusBursters trojan
Alternate VirusBurst / VirusBursters manual removal instructions

VirusBurst is a corrupt anti-spyware program illegally installed to user computers by widely spread trojans, through malicious advertisements and via numerous exploits. This application is not only a weak spyware remover, but also a clone of the infamous Spyware Quake risk.

VirusBursters is a successor of VirusBurst. Both programs have the same look, use identical parasite definitions databases and consist of terribly similar components. VirusBursters is actually an updated variant of VirusBurst – some minor, mostly cosmetic changes have been introduced in order to avoid detection by some security-related programs.

Results of thorough tests we have conducted reveal that although the program does not produce false positives and really finds some malicious parasites, it cannot completely eliminate most prevalent infections, and therefore is definitely unable to protect user privacy and system security.

The application refuses to remove any parasites it finds and asks to register and purchase the full version. Active Guard, the integrated real-time monitor, is also disabled.

VirusBurst / VirusBursters is a trojan that displays an icon in the system tray. This icon shows a message, which says that the compromised computer is infected with dangerous spyware parasites and asks the user to download and install a removal program, which actually is VirusBurst / VirusBursters, the same named corrupt illegally distributed spyware remover. Once the user clicks on that message, the trojan opens a web site distributing VirusBurst / VirusBursters. It may also try to download the application. The trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. VirusBurst / VirusBursters automatically runs on every Windows startup.

Your system is infected with VirusBurst / VirusBursters if you can see any of the following symptoms:

a) There is a suspicious icon in the system tray. It might be a circle with a red cross or an icon similar to one of the Windows Update tool.

b) A suspicious icon in the system tray pops up a message saying that your computer is infected with dangerous parasites. It asks you to download and install a removal program, which actually is VirusBurst / VirusBursters. This message usually contains the following text:

Critical System Error!
System detected virus activities. They may cause critical system failure. Please, use antimalware software to clean and protect your system from parasite programs.
Click this baloon to get all available software.

c) VirusBurst / VirusBursters, a corrupt spyware remover is installed to your system. It runs on every Windows startup. Program main windows are shown above.

d) Your Internet Explorer home page has changed and you cannot get it back. Now you get a warning page saying that spyware is detected on your PC and asking you to run a free scan in order to remove malware.

e) virusburst.exe or virusbursters.exe process is running.

f) Your HijackThis log contains any of the following entries:
O2 – BHO: (no name) – { [CLSID, a combination of letters and digits] } – [filename]
O3 – BHO: Protection Bar – { [CLSID, a combination of letters and digits] } – [filename]
O4 – HKLM\..\Run: [VirusBurst] C:\Program Files\VirusBurst\virusburst.exe
O4 – HKLM\..\Run: [VirusBursters] C:\Program Files\VirusBursters\virusbursters.exe

Removing the VirusBurst / VirusBurst trojan along with the same named corrupt spyware remover automatically is easy. Just follow these steps:

1. Download PC Tools Spyware Doctor or Webroot Spy Sweeper. These programs are the most effective and popular spyware removers available.
2. Install the downloaded program to your system. Read Spyware Doctor and Spy Sweeper tutorials to learn more.
3. Update the installed anti-spyware.
4. Run full system scan.
5. Remove all the threats the application will find.

Please note that eliminating the parasites automatically might be a paid function, which is not available in the limited free version. Purchasing Spyware Doctor or Spy Sweeper makes these products fully functional also enabling built-in real-time protection.

1. Download the SmitFraudFix tool and unpack its files to a chosen folder.

2. Download Pocket KillBox or KillBox utility.

3. Press Start > Settings, and open the Control Panel. Launch the Add or Remove Programs tool. In the list of installed software find the entry VirusBurst or VirusBursters. Uninstall the corresponding program.

4. Download the HijackThis program. Run a system scan, then fix the following entries (if present):
O2 – BHO: (no name) – { [CLSID, a combination of letters and digits] } – [filename]
O3 – BHO: Protection Bar – { [CLSID, a combination of letters and digits] } – [filename]
O4 – HKLM\..\Run: [VirusBurst] C:\Program Files\VirusBurst\virusburst.exe
O4 – HKLM\..\Run: [VirusBursters] C:\Program Files\VirusBursters\virusbursters.exe

5. Now restart your system in Safe Mode. This step is very important!
Please note that you need to have the administrator’s privileges.

6. Once in Safe Mode, run the SmitFraudFix tool by executing the smitfraudfix.cmd file.
Official SmitFraudFix tutorial can be found here.

7. Use either Pocket KillBox or KillBox to delete the following directories:
C:\Program Files\VirusBurst
C:\Program Files\VirusBursters
C:\Program Files\PCODEC

If you cannot download or use the SmitFraudFix tool, please follow alternate manual removal instructions:

1. Download Pocket KillBox or KillBox utility.

2. Press Start > Settings, and open the Control Panel. Launch the Add or Remove Programs tool. In the list of installed software find the entry VirusBurst or VirusBursts. Uninstall the corresponding program.

3. Download the HijackThis program. Run a system scan, then fix the following entries (if present):
O2 – BHO: (no name) – { [CLSID, a combination of letters and digits] } – [filename]
O3 – BHO: Protection Bar – { [CLSID, a combination of letters and digits] } – [filename]
O4 – HKLM\..\Run: [VirusBurst] C:\Program Files\VirusBurst\virusburst.exe
O4 – HKLM\..\Run: [VirusBursters] C:\Program Files\VirusBursters\virusbursters.exe

4. Now restart your system in Safe Mode. This step is very important!
Please note that you need to have the administrator’s privileges.

5. Once in Safe Mode, use either Pocket KillBox or KillBox to delete all the files from the list above present in your system.

Malicious files in C:\WINDOWS\System32 or C:\WINNT\System32:
cfltygd.dll
dcvwaah.dll
dpfwu.dll
duxzj.dll
eowygj.dll
fmrmhc.dll
impgsje.dll
jbtazy.dll
ficqv.dll
gqagksr.dll
gtpbx.dll
httge.dll
okkmtv.dll
oqabf.dll
qxfgcg.dll
rrtcany.dll
sacskza.dll
syycum.dll
tazth.dll
titiau.dll
veklo.dll
wuwbxp.dll
xtgwjrm.dll
zphnok.dll

Malicious files in C:\Program Files\VirusBurst:
virusburst.exe
vb.ini

Malicious files in C:\Program Files\VirusBursters:
virusbursters.exe
virusburster.ini

6. Delete the following directories (if present):
C:\Program Files\VirusBurst
C:\Program Files\VirusBursters
C:\Program Files\PCODEC