TrustSoldier is a new scareware program from WiniGuard family. It is installed from fake malware online scanner that displays that your PC is infected with a lot of threats and that you must install the software to clean your computer. The software is a trojan that will install TrustSoldier and create a lot of harmless files that TrustSoldier will determine as spyware and malware.
Once TrustSoldier is installed, it configures itself to run automatically every time, when you start your computer.
TrustSoldier
Once running, TrustSoldier will begin to scan your computer and list previously created files as infections to trick you to buy the paid version of TrustSoldier. All of these infections are fake, so you can safely ignore them!
While TrustSoldier is running you will be shown nag screens, fake security alerts, notifications from Windows task bar and other pop-ups. It will state that your computer is infected by an trojan or being attacked. Some of the alerts:
Spyware Alert!
Your computer is infected with spyware. It could damage your
critical files or expose your private data on the Internet. Click
here to register your copy of TrustSoldier and remove
spyware threats from your PC.
Security Center Alert!
Infiltration Alert!
Your computer is being attacked by an Internet
Virus. It could be a password-stealing attack,
a trojan-dropper or simular.
Also TrustSoldier will show a fake Windows Security Center that will recommend you register the software. However, all of these alerts are a fake and like scan false results should be ignored. If your computer is infected with TrustSoldier, then use these removal instructions below, which will remove TrustSoldier and any other infections you may have on your computer for free.
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [b48a17c.exe] C:\WINDOWS\system32\b48a17c.exe
O4 – HKCU\..\Run: [TrustSoldier] C:\Program Files\TrustSoldier Software\TrustSoldier\TrustSoldier.exe -min
Use the following instructions to remove TrustSoldier (Uninstall instructions)
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for TrustSoldier infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected for start TrustSoldier removal process. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
TrustSoldier creates the following files and folders
C:\WINDOWS\system32\b48a17c.exe
C:\Documents and Settings\All Users\Start Menu\Programs\TrustSoldier\1 TrustSoldier.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\TrustSoldier\2 Homepage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\TrustSoldier\3 Uninstall.lnk
C:\Program Files\TrustSoldier Software\TrustSoldier\TrustSoldier.exe
C:\Program Files\TrustSoldier Software\TrustSoldier\uninstall.exe
C:\Documents and Settings\All Users\Desktop\TrustSoldier.LNK
TrustSoldier creates the following registry keys and values
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustSoldier
HKEY_LOCAL_MACHINE\SOFTWARE\TrustSoldier
HKEY_CURRENT_USER\SOFTWARE\TrustSoldier
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b48a17c.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustSoldier
The above solutions didn’t work for me as the Trojan stopped me installing any software, getting on the internet, searching for files OR restoring to a later date. After 5 hours I fixed it by restarting windows in SAFE MODE then restoring windows to a point before the infection. I then installed Malwarebytes anti-malware and it found the infection and isolated it. I also ran my virus checker AFTER malwarebytes. I hope this saves you the 5 hours messing around with regit etc!!! God bless the Queen – The English