Rogue AVDefender 2011

Lovely newish exe killing rogue from the Antivirus Soft family.

Has two running processes and if one is killed then the other auto starts another.

Using a renamed Task Manager to iexplore you need to right click one process and select End Process Tree and even then it can be a bit of a struggle to end both processes.

Easiest way to cleanup this rogue is to leave both processes running and rename mbam.exe (Malwarebytes) to iexplore.exe to get a scan up and running then allow mbam to delete what it finds.

HitmanPro's hold left control while executing seems to fail against this one.

 

This is a newer rogue, thanks for spotting and bring the information to Wilders Removal guide here

 

Franklin, did you try Safe Returner with this rogue?

 

No, not as yet.

 

This software clearly is a goad to download and run
All three of the ad banners offering free scan and fix your PC now, Free Scan your PC now for errors, Scan your Computer for Free, all prompt a download of the executable for the program !!!

 

Safe Returner needs to renamed from Safe returner.scr to iexplore.exe in order to get a scan up and running.

It does detect and clean the rogue but "may" be a prob on XP after reboot and have PM'd egomoo to have a look.

Win 7 VM and a renamed Safe Returner comes up trumps but a scan with MBAM is advised to clean up dregs.

@siljane, I do volunteer as a Rogue Reporter for MBAM and usually wait a few days before posting here in order for the removal guides to get up first.

 

I know the folks at MBAM quite well, including Rubberducky, I don't quite understand why, Softpedia would sign off this software without having done due diligence on the software, imo, they clearly have not.

Is there an issue with the guide I posted ? If there is, your comments, it is not that I am aware of in Wilders TOS ?

If offsite removal guides are an issue, I should have been made aware of this.

 

No issue that I'm aware of and they are a great help to a lot of people.

 

Thanks for the kind feedback, as a security expert, I would only post removal guides that are from sites that I know and implicitly trust.

Complete discussion thread here, Franklin that we may both have missed.