Antivirus Protection is a rogue antivirus/antispyware program that usually installed itself onto your computer without your permission, through trojans. Also the rogue distributed through the use fake online malware scanners that tells you that your computer infected with spyware, malware and trojans and that you must install Antivirus Protection (AVProtectionSetup.exe) to clean your computer. Like other fake antivirus software, it does not offer any protection to computer users and uses fake alerts and false positives to trick user into buying the program.
Once Antivirus Protection is installed, it configures itself to run automatically every time, when you start your computer. Once running, the rogue will scan your computer and list a large amount of infections, but these “infections” are actually legitimate Windows files. Do not delete these files! The system scan shows fake infections in order to get the user to buy the software.
Antivirus Protection have included the file c:\windows\system32\SysShield.exe that will display a fake Windows Security Center called Antivirus Security Center on your computer that will recommend you register Antivirus Protection. Ignore the fake center! Use the free instructions below to remove Antivirus Protection and any associated malware from your computer.
Symptoms in a HijackThis Log
O4 – HKLM\..\Run: [AntiVirus Protection] C:\Program Files\AntiVirus Protection\AVP.exe
O4 – HKLM\..\Run: [Windows applications server] C:\WINDOWS\system32\SysShield.exe
Use the following instructions to remove Antivirus Protection (Uninstall instructions)
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for Antivirus Protection infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start Antivirus Protection removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Antivirus Protection creates the following files and folders
c:\WINDOWS\system32\SysShield.exe
c:\program files\antivirus protection\AVP.exe
c:\program files\antivirus protection\AVP_Update.exe
c:\program files\antivirus protection\Report.txt
c:\program files\antivirus protection\scanopt.sys
c:\program files\antivirus protection\Support.url
c:\program files\antivirus protection\svo.scf
c:\program files\antivirus protection\sysdata.sys
c:\program files\antivirus protection\SysShield.exe
c:\program files\antivirus protection\Uninstall.exe
c:\documents and settings\pedro adrian\Desktop\AntiVirus Protection.lnk
Antivirus Protection creates the following registry keys and values
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows applications server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus protection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\antivirus protection
This worked – thanks!