Remove AV Security Essentials - uninstall instructions

AV Security Essentials uninstall information

AV Security Essentials is another example of a cleverly designed scam. This fake antivirus program comes from a same family of misleading applications as Malware Protection Center, Antivirus Smart Protection, Smart Antimalware Protection and many other. As before Internet criminals are trying to mimic the interface of a legitimate security program Microsoft Security Essentials in their latest fake program called AV Security Essentials. As it's predecessors AV Security Essentials has nothing in common with a real security scanner, this program only imitates the processes involved in cleaning your computer from spyware, malware etc. AV Security Essentials are distributed using Trojans - when this malicious code installs itself on your computer using various security vulnerabilities it will eventually download and execute AV Security Essentials. After your computer is infected with this rogue security scanner you will notice a security scan every time you boot your operating system. This scan will end up in finding a big amount of security infections on your machine, if you click "Remove All" button you will be redirected to a website where you will be asked to purchase a licence for AV Security Essentials in order to remove the detected security threats. Don't fall for this trick - AV Security Essentials is a totally worthless program that is created with an intention of stealing money from your credit card account. All the security scans and security warning messages generated by this program are fake, AV Security Essentials doesn't have a virus definition database, a virus scan engine or anything in common with a legitimate computer antivirus program. If you have already payed for a licence of AV Security Essentials contact your credit card company and dispute the charges explaining that you have been tricked into purchasing a fake computer antivirus program. Use these removal instructions to remove AV Security Essentials and regain control of your PC.

Main window of AV Security Essentials:

AV Security Essentials removal:

remover for AV Security Essentials

Before downloading, enter AV Security Essentials registration key in the registration window. Click Help icon (at the top right corner of the main window of AV Security Essentials), then click Register Now and enter one of these keys.

U2FD-S2LA-H4KA-UEPB
K7LY-R5GU-SI9D-EVFB
K7LY-H4KA-SI9D-U2FD

If you can't download or run spyware remover try running registry fix (link below). It enables execution of programs. download registryfix.reg file, double click it, click YES and then OK.

AV Security Essentials removal instructions (on infected computer):

1. Start your computer in safe mode. Click Start, click Shut down, click Restart, click OK. During your computer starting process press F8 key on your keyboard multiple times until you see Windows Advanced Option menu, then select Safe mode with networking from the list.

2. Open Internet explorer, click Tools and select Internet Options. Select "Connections".

3.Click LAN settings, if a Use a proxy server for your LAN is checked, uncheck it and press OK.

4. Download HijackThis and save it on your desktop. Some malicious programs are able to block HijackThis so when you click the download link, in the Save dialog rename HijackThis.exe to iexplorer.exe and only then click the Save button. After saving the file on your desktop, double click it. In the main HijackThis window click “Do a system scan only” button. Select these entries (place a tick at the left of the entry):

O4 – HKCU\..\Run: [AV Security Essentials] “%AllUsersProfile%\<random characters>\<random characters>_<random numbers>.exe” /s /d

After selecting required entries, click "Fix Checked". After this procedure you can close HijackThis and proceed to the next removal step.

5. Download a legitimate anti-spyware software to fully remove AV Security Essentials from your computer.

remover for AV Security Essentials

6. After removing AV Security Essentials reset your Hosts files. Don't skip this step, this malware modifies your Hosts files, and you will encounter browser redirect problems.

Hosts file is used to resolve some canonical names of websites to ip addresses. When it is changed, the user may be redirected to malicious site still seeing good URL in address bar. It is very hard to find out if the site is genuine or not, when hosts file is modified. To fix this, please download Microsoft FixIt tool, that restores your hosts file to windows default. Run this tool when downloaded and follow the on-screen instructions. Download link below:

Other tools known to remove AV Security Essentials:

• iS3 STOPzilla
• Malwarebytes Anti-Malware

Additional information:

Some malicious software modifies browser settings and disables downloads of spyware and virus removing software. If you have problems downloading anti-spyware software with Internet Explorer, try downloading with Chrome, FireFox, Opera, etc.

If you can't access Internet:

Load your computer in safe mode. Click Start, click Shut down, click Restart, click OK. During your computer starting process press F8 key on your keyboard multiple times until you see Windows Advanced Option menu, then select Safe mode with networking from the list.

Start Task manager. Press ctrl+alt+del (or ctrl+shift+esc) and end task the processes of rogue program. ( if after this procedure you can't access any programs press ctrl+alt+del, click File, select New Task, and type explorer.exe then press OK.

Open Internet explorer, click Tools and select Internet Options. Select Connections, then click LAN settings, if a Use a proxy server for your LAN is checked, uncheck it and press OK.

After this procedure you should be able to access Internet. Now you can download anti-spyware software from our "Top spyware removers" section and run a full scan. Download, install and don't forget to update your selected anti-spyware program. Then run a full system scan.

If you are unable to remove AV Security Essentials, you can use this manual removal instruction. Use it at your own risk. If you don't have strong computer knowledge you could harm your operating system. Use it only if you are an experienced computer user. (Instructions on how to end processes, remove registry entries...)

End these AV Security Essentials processes:

random.exe

Remove these AV Security Essentials registry entries:

HKCU\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL

Delete these AV Security Essentials files:

%AllUsersProfile%\<random characters>\
%AllUsersProfile%\<random characters>\14.mof
%AllUsersProfile%\<random characters>\3178.mof
%AllUsersProfile%\<random characters>\46.mof
%AllUsersProfile%\<random characters>\6113.mof
%AllUsersProfile%\<random characters>\HS2d7_231.exe
%AllUsersProfile%\<random characters>\HSE.ico
%AllUsersProfile%\<random characters>\HSESys
%AllUsersProfile%\<random characters>\Quarantine Items
%AllUsersProfile%\HSYITSQGE
%AllUsersProfile%\HSYITSQGE\HSLGILTOGE.cfg
%AppData%\AV Security Essentials\
%AppData%\AV Security Essentials\Instructions.ini
%AppData%\AV Security Essentials\ScanDisk_.exe
%AppData%\Microsoft\Internet Explorer\Quick Launch\AV Security Essentials.lnk
%AppData%\Microsoft\Windows\Recent\CLSV.tmp
%AppData%\Microsoft\Windows\Recent\DBOLE.dll
%AppData%\Microsoft\Windows\Recent\PE.sys
%AppData%\Microsoft\Windows\Recent\SICKBOY.drv
%AppData%\Microsoft\Windows\Recent\SICKBOY.sys
%AppData%\Microsoft\Windows\Recent\delfile.dll
%AppData%\Microsoft\Windows\Recent\eb.dll
%AppData%\Microsoft\Windows\Recent\eb.sys
%AppData%\Microsoft\Windows\Recent\energy.dll
%AppData%\Microsoft\Windows\Recent\gid.tmp
%AppData%\Microsoft\Windows\Recent\pal.sys
%AppData%\Microsoft\Windows\Recent\ppal.drv
%AppData%\Microsoft\Windows\Recent\runddlkey.exe
%AppData%\Microsoft\Windows\Recent\snl2w.drv
%AppData%\Microsoft\Windows\Start Menu\Programs\AV Security Essentials.lnk
%AppData%\Microsoft\Windows\Start Menu\AV Security Essentials.lnk
%UserProfile%\Desktop\AV Security Essentials.lnk

General tips on removing AV Security Essentials:

*If you can't download anti-spyware software: Click on the download link, when the save dialog opens change the file name (example: when downloading mbam-setup.exe rename it to iexplore.exe).
*If you have installed anti-spyware program but you can't run it: Click Run, type %ProgramFiles% and press Enter. Open folder of your anti-spyware program, search for executable file and rename it. (example: Open Malwarebytes’ Anti-Malware folder, right-click on the main executable file (mbam.exe) then click rename. Rename the mbam.exe file to iexplore.exe, winlogon.exe firefox.exe ...
*If you can't access your anti-spyware software, try creating a new user account:
Click Start -> Settings -> Control panel.
Click User Accounts and create a new account.
Reboot your computer and login using a newly created user account.
*After this procedure you should be able to access your anti-spyware programs. Update and run a full system scan.