A relative of the well-known rogue anti-spyware programs Ghost Antivirus and Internet Antivirus, Live Enterprise Suite uses similar techniques to aggressively encourage the user to pay for a license to the software. Live Enterprise Suite uses online malware and fake malware scanners to enter the user’s system. Once installed, it immediately proceeds to disable essential Windows services such as Task Manager and Registry Editor. This way it ensures that the user cannot take steps to try and remove it. Furthermore, it creates random Windows Explorer paths so that users cannot find their way around the computer’s hard disk to delete Live Enterprise Suite files and folders. All these methods are employed to try and stop the user from deleting Live Enterprise Suite. This rogue software loads at boot time and starts performing fake system scans, flagging legitimate and harmless Windows files as dangerous spyware. It also insists that the currently installed ‘trial’ version of Live Enterprise Suite is insufficient to clean the user’s system, and insists that the user should pay for the ‘full’ version. However as these are false warnings the ‘full’ version could no more clean your computer than the ‘trial’ version could. So it is important not to fall for this trick.

In order to delete Live Enterprise Suite, it is necessary to stop its processes, unregister its DLLs, delete files and folders and remove registry entries.

File Removal Procedures

When taking steps to delete Live Enterprise Suite, the first is to kill the following processes:

• unins000.exe
• winlogon.exe
• services.exe
• atbyin.exe
• [random path]char.exe
• IAPro.exe

The next step is to unregister the following DLL files:

• WMILib.dll
• [random path].dll

The final step in file removal is deleting the files and folders themselves. To complete this step, remove the following files and folders from your computer:

• %UserProfile%\Application Data\Live Enterprise Suite
• %UserProfile%\Application Data\Live Enterprise Suite\settings.ini
• %UserProfile%\Application Data\Live Enterprise Suite\uill.ini
• %UserProfile%\Application Data\Live Enterprise Suite\unins000.exe
• %UserProfile%\Application Data\Live Enterprise Suite\updateloadlist.ini
• %UserProfile%\Application Data\Live Enterprise Suite\db
• %UserProfile%\Application Data\Live Enterprise Suite\db\config.cfg
• %UserProfile%\Application Data\Live Enterprise Suite\db\Timeout.inf
• %UserProfile%\Application Data\Live Enterprise Suite\db\Urls.inf
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Antivirus Pro.lnk
• %UserProfile%\Application Data\Microsoft\Windows\winlogon.exe
• %UserProfile%\Local Settings\Application Data\Microsoft\Windows\log.txt
• %UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
• %UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
• %UserProfile%\My Documents\My Pictures\atbyin.exe
• c:\Program Files\Common Files\[random path]char.exe
• c:\Program Files\Common Files\[random path]calc.exe
• c:\Program Files\Internet Antivirus Pro
• c:\Program Files\Internet Antivirus Pro\activate.ico
• c:\Program Files\Internet Antivirus Pro\Explorer.ico
• c:\Program Files\Internet Antivirus Pro\IAPro.exe
• c:\Program Files\Internet Antivirus Pro\unins000.dat
• c:\Program Files\Internet Antivirus Pro\uninstall.ico
• c:\Program Files\Internet Antivirus Pro\working.log
• c:\Program Files\Internet Antivirus Pro\db
• c:\Program Files\Internet Antivirus Pro\db\DBInfo.ver
• c:\Program Files\Internet Antivirus Pro\db\ia080614.db
• c:\Program Files\Internet Antivirus Pro\db\lists.ini
• c:\Program Files\Internet Antivirus Pro\db\WMILib.dll
• c:\Program Files\Internet Antivirus Pro\Languages
• c:\Program Files\Internet Antivirus Pro\Languages\IAEs.lng
• c:\Program Files\Internet Antivirus Pro\Languages\IAFr.lng
• c:\Program Files\Internet Antivirus Pro\Languages\IAGer.lng
• c:\Program Files\Internet Antivirus Pro\Languages\IAIt.lng
• c:\WINDOWS\system32\[random path].dll
• c:\WINDOWS\system32\[random path].dll
• c:\Documents and Settings\All Users\Desktop\Internet Antivirus Pro.lnk
• c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro
• c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Internet Antivirus Pro Home Page.lnk
• c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Internet Antivirus Pro.lnk
• c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Purchase License.lnk
• c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Uninstall Internet Antivirus Pro.lnk

Once the files have been removed, your file system is safe from Live Enterprise Suite.

Registry Removal Procedures

In order to delete Live Enterprise Suite completely from your system, the following registry keys and settings should also be removed:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “Debugger”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “RealDebugger”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\567 1.4.2.0_is1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Enterprise Suite_is1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HTGRDENGINE
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTGrdEngine
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTGRDENGINE
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTGrdEngine
• HKEY_CURRENT_USER\Software\Microsoft\FTP “SearchDir” = “c:\program files\Internet Antivirus Pro\”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run “[random]“
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Live Enterprise Suite”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Microsoft Windows logon process”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION “svchost.exe”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent “URIAPRO[]“
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent “URIAPRO[]“

Once these entries have been removed from the Windows Registry, your computer is completely safe from Live Enterprise Suite. In order to make sure that Live Enterprise Suite has been deleted accordingly it is however recommended to scan the entire computer using Spyware Doctor with Antivirus.

Conclusion

Only experienced computer users should attempt to delete Live Enterprise Suite manually, as any wrong move made due to inexperience could cause unwanted damage to your system. The best way for inexperienced users is to use a genuine remote computer repair service such as www.onlinecomputerrepair.org as it can ensure complete repair procedures remotely under a money back guarantee policy.