[daniel1212]

http://www.2-spyware.com/remove-antivirus-soft.html

Antivirus Soft manual removal:

Kill processes:
[RANDOM CHARACTERS]sysguard.exe, for example ghrtsysguard.exe [RANDOM CHARACTERS]sftav.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""
HKEY_CURRENT_USER\Software\AvScan

HELP:
how to remove registry entries

Delete files:
Windows XP: %UserProfile%\\Local Settings\\Application Data\\\\[RANDOM CHARACTERS]sysguard.exe Windows Vista and Windows 7: %UserProfile%\\AppData\\Local\\\\[RANDOM CHARACTERS]sysguard.exe %UserProfile%\\AppData\\Local\\\\[RANDOM CHARACTERS]sftav.exe

HELP:
how to remove harmful files

Delete directories:
%UserProfile%\Local Settings\Application Data\[RANDOM CHARACTERS]\ (Win XP)
%UserProfile%\AppData\Local\\ (Win Vista & 7)

[TChad]

I’m not sure it’s a good idea to remove HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “”. It will probably contain some legit entries. HKCU\Software\Microsoft\Windows\CurrentVersion\Run “” also might contain legit entries.