Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I got wacked with the spyware "Total Security" which shows fake scans etc. What legit remover-tool can I use to get this out? All AV scanners refuse to remove it.

share|improve this question

migrated from serverfault.com Aug 29 '09 at 0:07

This question came from our site for professional system and network administrators.

    
Just out of curiosity, what AV software are you running? –  John Gardeniers Aug 28 '09 at 22:04
add comment

7 Answers

Get a copy of Malwarebytes Anti-Malware from www.malwarebytes.org. Update its definitions and let it run a full scan. It has handled every fake anti-virus/anti-spyware app that I have thrown at it with no problems. Once you've got everything cleaned up, get a copy of Spybot Search & Destroy and use its immunize feature on a regular basis to help keep your PC protected.

share|improve this answer
add comment

I'd also recommend installing at least one of the free anti-spyware tools in addition to av software. My own favourite is spybot search and destroy but other people prefer ad-aware. If possible set it to scan on a schedule otherwise run it manually at least once a week.

share|improve this answer
add comment

Try this:

http://www.2-spyware.com/remove-total-security.html


Total Security manual removal:

Kill processes:

tsc.exe Sc2C21UvvM.exe

Delete registry values:

HKEY_CURRENT_USER\Software\1FD92E3F7C34799BFB075C41DA05D1FE

HKEY_CLASSES_ROOT\CLSID{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "1FD92E3F7C34799BFB075C41DA05D1FE"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"

Unregister DLLs:

winsource.dll

Delete files:

tsc.exe

Sc2C21UvvM.exe

winsource.dll

TSC.lnk

Help.lnk

Registration.lnk

Uninstall TSC.lnk

Delete directories:

c:\Program Files\TSC

%UserProfile%\Start Menu\TSC

c:\Program Files\Common Files\System\Uninstall


NOTE: If you're unable to do some of the steps above... boot up in SAFE MODE and try the steps again.

share|improve this answer
    
I tried this earlier. This seems to be a new variant. –  Saif Khan Aug 28 '09 at 21:38
add comment

SmitFraudFix should take care of this.

share|improve this answer
add comment

Have you tried Malwarebytes' Anti-Malware?

Try it if you didn't. Don't forget to manually update the virus database (it's only automatic for the paid version).

share|improve this answer
add comment

Malwarebytes' Anti-Malware is very good, so is SuperAntiSpyware (http://www.superantispyware.com). With it, you also have to update manually for the free version.

share|improve this answer
add comment

You could try following the instructions on this page:
http://www.wiki-security.com/wiki/Parasite/TotalSecurity

It describes what the malware "Total Security" does, has tools to check if it has infected your computer, and instructions on how to remove it.

share|improve this answer
    
WARNING This looks like a fake site started by the owners of total security. –  MGOwen Apr 18 '11 at 9:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.