Hailing from the notorious family of rogue antivirus applications to which PC Live Guard also belongs, Security Antivirus is a fake antivirus program that tries to trick the user into purchasing its license. Security Antivirus gets itself installed on user systems by using fake online malware scanners and Trojan viruses. Once installed, Security Antivirus creates a large number of fake but harmless files one the hard disk. Later it performs fake scans on the system reporting these files as dangerous viruses. Security Antivirus also generates fake warnings from the Windows taskbar in the form of pop-ups, also warning about external hackers trying to access the system. At the same time, Security Antivirus keeps encouraging the user to buy the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is inadequate to remove the detected threats. However, it is important to remember that the so-called ‘full’ version cannot in scan or clean your computer in any way.

As soon as you find a copy of this rogue software on your computer, you should take steps to remove it. Security Antivirus removal involves the killing of processes, unregistering of DLLs, deletion of files and folders and removal of registry entries.

File Removal Procedures

The first step in Security Antivirus removal is to kill the following processes:

• SA345d.exe
• ANTIGEN.exe
• PE.exe
• std.exe

Next, it is necessary to unregister the following DLLs:

• mozcrt19.dll
• sqlite3.dll
• cid.dll
• ddv.dll
• runddlkey.dll

The final step in file removal is to delete the following files and folders:

• c:\Documents and Settings\All Users\Application Data\345d567\
• c:\Documents and Settings\All Users\Application Data\345d567\72.mof
• c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
• c:\Documents and Settings\All Users\Application Data\345d567\SA345d.exe
• c:\Documents and Settings\All Users\Application Data\345d567\SAV.ico
• %UserProfile%\Application Data\Security Antivirus
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Antivirus.lnk
• %UserProfile%\Application Data\Security Antivirus\cookies.sqlite
• %UserProfile%\Desktop\Security Antivirus.lnk
• %UserProfile%\Recent\ANTIGEN.drv
• %UserProfile%\Recent\ANTIGEN.exe
• %UserProfile%\Recent\cid.dll
• %UserProfile%\Recent\CLSV.drv
• %UserProfile%\Recent\DBOLE.sys
• %UserProfile%\Recent\ddv.dll
• %UserProfile%\Recent\ddv.sys
• %UserProfile%\Recent\energy.tmp
• %UserProfile%\Recent\FS.drv
• %UserProfile%\Recent\gid.drv
• %UserProfile%\Recent\PE.drv
• %UserProfile%\Recent\PE.exe
• %UserProfile%\Recent\PE.sys
• %UserProfile%\Recent\PE.tmp
• %UserProfile%\Recent\runddlkey.dll
• %UserProfile%\Recent\std.exe
• %UserProfile%\Recent\tjd.drv
• %UserProfile%\Recent\tjd.sys
• %UserProfile%\Start Menu\Security Antivirus.lnk
• %UserProfile%\Start Menu\Programs\Security Antivirus.lnk
• c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
• c:\Documents and Settings\All Users\Application Data\345d567\BackUp
• c:\Documents and Settings\All Users\Application Data\345d567\BackUp\Adobe Reader Speed Launch.lnk
• c:\Documents and Settings\All Users\Application Data\345d567\BackUp\Adobe Reader Synchronizer.lnk
• c:\Documents and Settings\All Users\Application Data\345d567\Quarantine Items\
• c:\Documents and Settings\All Users\Application Data\345d567\SAVSys\
• c:\Documents and Settings\All Users\Application Data\345d567\SAVSys\vd952342.bd
• c:\Documents and Settings\All Users\Application Data\SADFIOPODIV\SAAKDUPV.cfg
• c:\Program Files\Mozilla Firefox\searchplugins\search.xml

Once these steps have been completed, Security Antivirus no longer resides on your hard disk. However, due to the fact that in most cases Security Antivirus is installed by additional malicious software it is recommended to conduct a full system scan using genuine software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

Removing files and folders is not enough to ensure complete Security Antivirus removal. To ensure complete deletion, the following keys and settings should also be removed from the registry:

• HKEY_CURRENT_USER\Software\3
• HKEY_CLASSES_ROOT\SA345d.DocHostUIHandler
• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=195&q={searchTerms}”
• HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://findgala.com/?&uid=195&q={searchTerms}”
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PRS” =”http://127.0.0.1:27777/?inj=%ORIGINAL%”
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “App/7.00195″
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Security Antivirus”

After you have completed the removal of these registry entries, your system is completely safe from Security Antivirus.

Conclusion

Manual Security Antivirus removal is not recommended for inexperienced users, as any mistake made due to inexperience could damage the integrity of the system. Inexperienced users are advised to use an online repair service such as www.onlinecomputerrepair.org or legitimate antivirus software for proper Security Antivirus removal.