We searched the web for a fix to our problem – couldn’t find one for antivirus 360. Here were the symptoms we identified on a PC:
* Windows registry would only stay open for 10 seconds
* Windows CMD would not open
* Anti-virus and Firewall were disabled and removed
* Windows Security Center disabled – you don’t see the shield
* Browser redirected to malicious websites
* Not able to download or update ANY security products
We suggest you use Malwarebytes which does a great job of removing most of the malicious files. Before you install Malwarebytes (or any security software including being able to download windows updates) you need to search for and remove the following entries, otherwise Malwarebytes (or any other security software) will not work properly, download or install:
* Winconfig.dll
* A360.exe
* Winsystems.dll
* DELETE all files in the "PREFETCH" folder
On deletion of the above files, you can now download and install Malwarebytes.
TIP: We couldn’t update so we had to update the database manually. Click here for manual download.
Here are the keys, data items, files and folders that you should remove:
Registry Keys Infected:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{d263fa6d-84cc-48a8-9af6-c664362b7a5b}
HKEY_CLASSES_ROOTCLSID{d263fa6d-84cc-48a8-9af6-c664362b7a5b}
HKEY_LOCAL_MACHINESOFTWAREUAC
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUACd.sys
Registry Data Items:
HKEY_CURRENT_USERSOFTWAREPoliciesMicrosoftInternet ExplorerControl PanelHomepage
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify (Disabled.SecurityCenter)
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterFirewallDisableNotify (Disabled.SecurityCenter)
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter)
Folders Infected:
A360 (Rogue.A360Antivirus)
Files Infected:
A360.lnk
Help.lnk
Registration.lnk
A360.lnk
MicrosoftInternet ExplorerQuick LaunchA360.lnk
C:WINDOWSsystem32uacinit.dll
C:WINDOWSsystem32UACftdrxsnm.dll C:WINDOWSsystem32UACpulqeavn.dat C:WINDOWSsystem32UACrtaxtmsn.log
On completing this scan/removal and rebooting Malwarebytes you should now be able to update automatically (and other security software including windows update should now be ok too)
Installing Antivirus and a Firewall
You should now install your antivirus (this will also activate the appropriate product updates as well as Windows Security updates – you should now see the Windows Security Shield in the TASK BAR).
We use avast! – download, install and run a boot scan (it will prompt you to do this after installation) which should find these infected files:
C:documents and settingsuserlocal settingsPgmm.ltm [Trojan]
C:DOCUME~1userLOCALS~1PGMM.LTM [Trojan]
C:WINDOWSsystem32kernel32.dll
C:WINDOWSsystem32winsock.dll
C:WINDOWSsystem32wsock32.dll
You will be advised to restart your PC.
Having restarted your PC you will now need to download and install a Firewall. We recommend ZoneAlarm and it is 100% FREE!
For added assurance I suggest you download Spyware Terminator. It’s 100% FREE and will monitor every action. It also comes with a handy ‘Safe Web Search’ tool which places a GREEN shield next to safe websites.
Lastly you will need to update Windows Security. Click here. Safe surfing folks!
* Be very careful when making any changes to the Windows Registry. We suggest you make a Windows Registry backup before making any changes.
Safe surfing folks!
Julian Evans
