The most important thing everyone has to know about Smart Security is that this is extremely annoying and perilous software that pretends to be antispyware application. The only thing Smart Security cares about is your money and the methods that can be used in order to own your wallet. Smart Security can invade you computer even when do not expect, and without doubts will do it unnoticeably for the user. With the first second Smart Security is inside, it will spread out various random files over your computer’s system and then detect these files as infections. Please remember that Smart Security was designed the way it only scams and fools users out of their money. Be certain of Smart Security’s nasty activity, as it is absolutely unreliable and under no circumstances should be believed in. What is more, while using Smart Security as a protection shield for your computer, you are going to face countless tiresome pop-ups that will notify you about various nasty activities are happening. With no doubts, such information should be disregarded and no instructions should be followed. Smart Security invades not only your system but your Internet browser as well which makes surfing the net a bit of a problem in many aspects. As you have mentioned, in order to prevent various mistakes and keep you computer work appropriately Smart Security should be ignored and removed, and sooner you will do it, better it is going to be for you and your beloved computer.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical
Screenshot:

How to remove Smart Security manually:

The files to be deleted:

C:\Program Files\Smart Security
%CommonPrograms%\Smart Security
SmartSecurity.exe

Remove registry entries:

XP Antivirus Pro 2010 is nasty software that masquerades to be protecting your computers like legitimate antivirus programs. The only thing XP Antivirus Pro 2010 is capable for is stealing money from your wallet and fooling users in various ways. XP Antivirus Pro 2010 will get inside your computer with the help of Trojan and this is one of the countless negative features XP Antivirus Pro 2010 has. Also, XP Antivirus Pro 2010 will never give up and is going to do its best for the self protecting. In order that all active antivirus applications would be disabled, so nothing could stop XP Antivirus Pro 2010. The Internet is a great source of danger for XP Antivirus Pro 2010 as well. That is why browsing the World Wide Web would be actually pretty difficult as XP Antivirus Pro 2010 will get over it and will not let you visit many web sites alerting about theirs insecurity. Though it looks like XP Antivirus Pro 2010 is desirable for the security of your computer, it is absolutely not true. Moreover, during XP Antivirus Pro 2010 is acting you will face tons of various security warnings all over your desktop that will make it extremely annoying and hard to work with your PC. As you see, XP Antivirus Pro 2010 is the application that should be always avoid and never trusted, whatever it says or warns you about.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical
Screenshot:
How to remove XP Antivirus Pro 2010 manually:

The files to be deleted:

%Documents and Settings%\[UserName]\Application Data\av.exe
%Documents and Settings%\[UserName]\Application Data\WRblt8464P

Remove registry entries:

Please be careful because manual removal of XP Antivirus Pro 2010 may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. So we strongly recommend you to use automatical removal tool.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical

How to remove Antivirus Vista 2010 manually:

The files to be deleted:

av.exe
WRblt8464P

Remove registry entries:

Do you concern about such application as Antimalware Doctor? One may think that this is actually very helpful tool to fight all infections inside his computer. In fact, Antimalware Doctor is rogue antispyware program that will never protect your computer, as well as all private documents being stored in there. Antimalware Doctor is classified as rogue application, as it uses fake system scan and tricking strategies in order to influence you into spending users’ money on nothing wholesome. Antimalware Doctor is constructed the way it will begin getting over your PC immediately after installation. First of all, every antivirus activity would be blocked, and may be removed. Moreover, you can find it difficult to work inside the world web, as much of the websites you would like to visit would be denied by Antimalware Doctor stating about their insecurity. Very probably, such links can just drop you to the security page that will detect and removed Antimalware Doctor. When invaded your computer, Antimalware Doctor will immediately scan your computer and will state about infections detected. They are so numerous, but at the same time so harmless. The deal is, none of those threats are actually dangerous. Moreover, some of them can be legitimate Windows portion, which removing is definitely not recommended. What is highly advised is to remove Antimalware Doctor from your PC because sooner or later it will get over your whole computer and there would be no way out of this huge trouble.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical
Screenshot:


How to remove Antimalware Doctor manually:

The files to be deleted:

%Windows%\System32\enemies-names.txt
%Windows%\System32\Antimalware Doctor.exe

Remove registry entries:

HKEY_CURRENT_USER\Software\Antimalware Doctor Inc\Antimalware Doctor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Antimalware Doctor.exe”

Please be careful because manual removal of Antimalware Doctor may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. So we strongly recommend you to use automatical removal tool.

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical
Screenshot:
How to remove My Security Wall manually:

The files to be deleted:

%Documents and Settings%\All Users\Application Data\117fc
%Documents and Settings%\All Users\Application Data\117fc\MS339.exe
%Documents and Settings%\All Users\Application Data\117fc\MSW.ico
%Documents and Settings%\All Users\Application Data\117fc\7463.mof
%Documents and Settings%\All Users\Application Data\117fc\mozcrt19.dll
%Documents and Settings%\All Users\Application Data\117fc\sqlite3.dll
%Documents and Settings%\All Users\Application Data\117fc\BackUp\Adobe Reader Speed Launch.lnk
%Documents and Settings%\All Users\Application Data\117fc\BackUp
%Documents and Settings%\All Users\Application Data\117fc\BackUp\Adobe Reader Synchronizer.lnk
%Documents and Settings%\All Users\Application Data\117fc\MSWSys
%Documents and Settings%\All Users\Application Data\117fc\MSWSys\vd952342.bd
%Documents and Settings%\All Users\Application Data\117fc\Quarantine Items
%Documents and Settings%\All Users\Application Data\MSEAIVCW
%Documents and Settings%\All Users\Application Data\MSEAIVCW\MSGWBQLMRPW.cfg
%Documents and Settings%\[UserName]\Application Data\My Security Wall
%Documents and Settings%\[UserName]\Application Data\My Security Wall\cookies.sqlite
%Documents and Settings%\[UserName]\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Wall.lnk
%Documents and Settings%\[UserName]\Desktop\My Security Wall.lnk
%Documents and Settings%\[UserName]\Recent\ANTIGEN.tmp
%Documents and Settings%\[UserName]\Recent\dudl.sys
%Documents and Settings%\[UserName]\Recent\energy.drv
%Documents and Settings%\[UserName]\Recent\exec.dll
%Documents and Settings%\[UserName]\Recent\exec.drv
%Documents and Settings%\[UserName]\Recent\grid.drv
%Documents and Settings%\[UserName]\Recent\hymt.drv
%Documents and Settings%\[UserName]\Recent\kernel32.exe
%Documents and Settings%\[UserName]\Recent\pal.drv
%Documents and Settings%\[UserName]\Recent\PE.drv
%Documents and Settings%\[UserName]\Recent\ppal.exe
%Documents and Settings%\[UserName]\Recent\tempdoc.dll
%Documents and Settings%\[UserName]\Recent\tempdoc.drv
%Documents and Settings%\[UserName]\Recent\tjd.tmp
%Documents and Settings%\[UserName]\Start Menu\My Security Wall.lnk
%Documents and Settings%\[UserName]\Start Menu\Programs\My Security Wall.lnk
%Program Files%\Mozilla Firefox\searchplugins\search.xml

Remove registry entries:

Don’t bother about scanning as scanners cant fully fix your problem and will end up corrupting your applications.

Boot in safe mode. The reason for this is that in safe mode there is not much processes running. You need this setup in step 9 below as this virus is a nasty one.
Open up windows explorer and go to Tools -> Folder options .
a. Make sure the following are TICKED -> Show hidden files and folders
b. Make sure the following are UNticked -> Hide Extensions for known file types
Go to the following directories (this is for vista home premium):
C:\Program Files\Internet Explorer
C:\Users\user\AppData\Local\Temp
And you will see there a file called wmpscfgs.exe. Delete them.
Open up your task manager, make sure the ’show all processes’ is ticked and look for the same process. If it is running. Kill it.
Starting this part, steps needs more technical experience. If you are not comfortable in doing the below steps, look for someone that can help you.

Open up regedit and go to: HKLM->Software -> Microsoft -> Windows -> CurrentVersion –> Run
Look for Adobe_reader entry with data: “%ProgramFiles%\Internet Explorer\wmpscfgs.exe“. Delete it. For me from this point almost all of the things written in the NET currently don’t have the steps below. And its the reason why this virus keeps coming back.
Hopefully you dont have much applications under “HKLM->Software -> Microsoft -> Windows -> CurrentVersion -> Run”. Because you have to visit each one of them literally because this virus hijacks almost every application in the RUN list above.
Basically it renames the old exe file from say “mcagent.exe” to “mcagent .exe”. With a space between the filename and the “.exe” or extension. It will then create a copy of itself with the same filename as your executable file so that when someone executes your file, the virus will be executed first then your file. It will do this for every apps you have in your Run list.
Thus if you go to the location of say of McAfee mcagent.exe application you will see two to three files with almost the same filename:

mcagent.exe -> which is a 39 KB file, and very recently created and which is the virus that keeps adding back that wmpscfgs.exe file.
mcagent .exe -> the original mcagent file, renamed.
mcagent.exe.delme -> delete this one as well. I don’t see this occurring every time, but i have seen some apps with this file in them and very recently created.
You first need to kill the corresponding process of the infected file if they are running in task manager, manually remove the existing .exe file which is around 39KB only and rename back your old executable file to its former filename. Repeat this for every application you have in your Run list above. The only thing that i saw this virus didn’t infect was the windows defender application. The rest in my Run list were screwed. Uninstalling and reinstalling them doesn’t help as well as the former Trojan exe file will be retained in the application directory.
This is the reason why Microsoft Security Essentials was complaining that your startup executable files are viruses.

Once you have verified that each application in your run list has been restored. To be fully sure that you don’t have any such files lingering in your system, do a drive search for any file that has 39KB size and has just been recently created and examine each one carefully if they are just copies of your original executable file. Follow step 7 for each occurrence of it. So far, i only saw this virus attach itself into executable files.
If you want to be 100% sure, next thing you need to do is double check every process running in your task manager if they are legit. Some process specially those started by system wont be able to take you to its process file, its ok, but most of them if you do a right click in them, you should see an option there called “Open File Location”. Then follow steps 7 above.
Reboot and that’s it!