Fake Windows Activation Screen Removal Guide

Fake Windows Activation Screen is a Trojan which pretends to be a Windows Activation program. The infected computer will show a screen simulating Microsoft Windows Activation which state that Windows needs to be reactivated. Fake Windows Activation Screen will force users to enter their name, contact information and credit card details to cheat their money. After that, the credit card will be charged.

Removal Guide
Kill Process
(How to kill a process effectively?)
$SYSDIR\.exe

Unregister DLL files
%UserProfile%\Application Data\mtl.dll

Delete Registry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
HKEY_CURRENT_USER\Software\
HKEY_CURRENT_USER\Software\AntiPiracy

Remove Folders and Files
%UserProfile%\Application Data\mtl.dll
$SYSDIR\.exe

Read more:
Constants in manual removal guide

Read more »

SystemArmor Removal Guide

SystemArmor (System Armor) is a fake antispyware program from the WiniGuard family of rogues. System Armor gets into your PC when you download a video codec, or update your flash player. Once active, the fake antivirus starts threatening users with false warning. SystemArmor scans your computer every time you boot your Windows, and send fake warnings and alerts that your computer is in danger. This is a scam and try to cheat users to purchase SystemArmor.

Removal Guide
Kill Process
(How to kill a process effectively?)
SystemArmor.exe
gt.exe

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SystemArmor"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe"
HKEY_LOCAL_MACHINE\SOFTWARE\SystemArmor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemArmor
HKEY_CURRENT_USER\Software\SystemArmor

Remove Folders and Files
%Temp%\[random]gt.exe
%WINDIR%\system32\[random]gt.exe
%ALLUSERSPROFILE%\Start Menu\Programs\SystemArmor
%ALLUSERSPROFILE%\Desktop\SystemArmor.lnk
%ProgramFiles%\SystemArmor Software

Read more »

Live Security Suite Removal Guide

Live Security Suite (LiveSecuritySuite) is a fake antivirus program which infect your PC when you download a video codec, or update your flash player. Live Security Suite scans your computer everytime you boot your Windows up, and send fake warnings and alerts that your computer is in danger. This is a scam and try to get users to purchase Live Security Suite. Remove Live Security Suite from the infected system immediately.

Removal Guide
Kill Process
(How to kill a process effectively?)
LiveSS.exe
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
%UserProfile%\Application Data\Live Security Suite\unins000.exe

Unregister DLL files
%ProgramFiles%\Live Security Suite\db\WMILib.dll

Delete Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "UpdatesDisableNotify" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent "URLSS[2.0.3.0]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AVPath" = "\\.\root\SecurityCenter:AntiVirusProduct.instanceGuid="{653E64F8-62B6-4F96-B22D-4FFC6E44130E}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirstRunDisabled" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallDisableNotify" = "0"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Live Security Suite"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "uniname" = "Live Security Suite_is1"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PrS" = "http://gen-avpay.com/choose/?productid=GENAV3&uid=0&machineid=c3f92274b4b15694ae2311bd2316c727"
HKEY_CURRENT_USER\Software\Live Security Suite
HKEY_CURRENT_USER\Software\Microsoft\FTP "SearchDir" = "C:\Program Files\Live Security Suite\"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Suite_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Live Security Suite

Remove Folders and Files
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
%UserProfile%\Desktop\LiveSS.exe.txt
%UserProfile%\Desktop\Live Security Suite.lnk
%UserProfile%\Application Data\Live Security Suite
%Program Files%\Live Security Suite

Read more »