• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

My AntiSpyware

Free antispyware software, Online Scanners, Instructions on how to remove spyware and malware.

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools
Home › Browser Hijacking › Malware removal › Tutorials - HowTo › How to remove avcommand.net (Browser hijacker)

How to remove avcommand.net (Browser hijacker)

Myantispyware team March 2, 2010     No Comment    

avcommand.net a malicious site, which is managed by the creators of the program called Antivirus Soft. This program is a fake security application that also known as rogue antispyware. The rogue is promoted and installed onto computer through the use of trojans. During installation, Antivirus Soft configures your browser (Internet Explorer) in such a way that it can redirect you to the avcommand.net.

Thus, when you open any site, instead it will display a page from the avcommand.net, which reported that a visit to open the site is dangerous, because it contains malicious exploits that can launch a virus on your computer. This warning is nothing but a fake, so you can safely ignore it.

Obviously, you can not trust neither the avcommand.net website nor its affiliate Antivirus Soft. These two created with one purpose, to trick you into purchasing the full version of the fake antispyware program. Do not waste your time and money and in any case do not buy anything from avcommand.net! Use the following removal instructions to remove avcommand.net hijacker and its related Antivirus Soft rogue antispyware program.

Symptoms in a HijackThis Log

O4 – HKLM\..\Run: [RANDOM] %UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]sysguard.exe
O4 – HKCU\..\Run: [RANDOM] %UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]sysguard.exe
O4 – HKLM\..\Run: [RANDOM] %UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]ftav.exe
O4 – HKCU\..\Run: [RANDOM] %UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]ftav.exe

Use the following instructions to remove avcommand.net hijacker and its related Antivirus Soft

Step 1.

Download HijackThis from here. Once Save dialog opens, please rename HijackThis.exe to iexplore.exe as shown below.


Save Dialog – HijackThis.exe


Save Dialog – iexplore.exe

Click Save button to save it.

Doubleclick on the iexplore.exe to run HijackThis. HijackThis main menu opens.

Click “Do a system scan only” button. Look for lines that looks like:

R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
O4 – HKLM\..\Run: [arlsknkw] C:\Documents and Settings\user\Local Settings\Application Data\lqtwnu\wqcmsysguard.exe
O4 – HKCU\..\Run: [arlsknkw] C:\Documents and Settings\user\Local Settings\Application Data\lqtwnu\wqcmsysguard.exe
O4 – HKLM\..\Run: [vcspymsv] C:\Documents and Settings\user\Local Settings\Application Data\vcspymsv\qweqftav.exe
O4 – HKCU\..\Run: [udcqinjy] C:\Documents and Settings\user\Local Settings\Application Data\udcqinjy\sdfdftav.exe

Note: list of infected items may be different, but all of them have “sysguard.exe” or “ftav.exe” part in a right side and “O4″ in a left side.

Place a checkmark against each of them. Once you have selected all entries, close all running programs then click once on the “fix checked” button. Close HijackThis.

Step 2.

Download MalwareBytes Anti-malware (MBAM). Once downloaded, close all programs and windows on your computer.

Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MalwareBytes Anti-malware onto your computer. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to “Update Malwarebytes’ Anti-Malware” and Launch “Malwarebytes’ Anti-Malware”. Then click Finish.

MalwareBytes Anti-malware will now automatically start and you will see a message stating that you should update the program before performing a scan. If an update is found, it will download and install the latest version.

As MalwareBytes Anti-malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main menu. You will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Make sure the “Perform quick scan” option is selected and then click on the Scan button to start scanning your computer for avcommand.net hijacker and its related Antivirus Soft infection. This procedure can take some time, so please be patient.

When the scan is finished a message box will appear that it has completed scanning successfully. Click OK. Now click “Show Results”. You will see a list of infected items similar as shown below.
Note: list of infected items may be different than what is shown in the image below.

Malwarebytes Anti-malware, list of infected items
Malwarebytes Anti-malware, list of infected items

Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove avcommand.net hijacker and its related Antivirus Soft. MalwareBytes Anti-malware will now remove all of associated avcommand.net hijacker and its related Antivirus Soft files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

avcommand.net hijacker and its related Antivirus Soft creates the following files and folders

%UserProfile%\Local Settings\Application Data\[RANDOM]
%UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]sysguard.exe
%UserProfile%\Local Settings\Application Data\[RANDOM]\[RANDOM]ftav.exe

avcommand.net hijacker and its related Antivirus Soft creates the following registry keys and values

HKEY_CURRENT_USER\Software\AvScan
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[RANDOM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[RANDOM]

Browser Hijacking Malware removal Tutorials - HowTo

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

Leave a Reply Cancel reply




New Guides

unwanted ads
How to uninstall ValidMemory app/extension from Mac
unwanted ads
How to uninstall AdvancedSprint app/extension from Mac
Bright Tab redirects
How to uninstall Bright Tab from Chrome, Firefox, IE, Edge
Municationa.biz
How to remove Municationa.biz pop-ups (Virus removal guide)
1GGZpqXsqKWSRnjJ1SHFaE5VPkMHHsKToX
1GGZpqXsqKWSRnjJ1SHFaE5VPkMHHsKToX Bitcoin Email Scam

Follow Us

Search

Useful Guides

Files encrypted by ransomware become useless
How To Recover Encrypted Files (Ransomware file recovery)
How to remove pop-up ads [Chrome, Firefox, IE, Opera, Edge]
Malwarebytes won’t install, run or update – How to fix it
Tech Support Scam
Remove Tech Support Scam pop-up virus [Microsoft & Apple Scam]
Best free malware removal tools
Best Free Malware Removal Tools 2020

Recent Posts

How to remove Dr. Guard (Uninstall instructions)
How to backup Windows Registry using ERUNT
How to remove XP AntiSpyware 2010, XP Antivirus Pro 2010
How to remove Virus Protector (Uninstall instructions)
How to remove PC Defender (Uninstall instructions)

MYANTISPYWARE.COM

  • About Us
  • Contact Us
  • Privacy Policy

NEED A HELP ?

If you're seeing unwanted pop-ups or ads in your web-browser, you might have an adware installed on your computer. Use the following guide to stop pop-up ads and remove malicious software. Or ask for help here.

Links

  • Downloads
  • Instructions
  • Questions and Answers
  • Free Malware Removal Tools
Copyright © 2004 - 2020 My AntiSpyware - Free antispyware programs and Spyware Removal Instructions.