How to remove Live Security Platinum?

[primavera]

Guys, I really need some help here. I thought that problems with fake software are not very difficult to be solved, but I realized it is not so. Today when I turned my PC on I saw some program called Live Security Platinum to be scanning my system. This tool did not ask me whether or not it is allowed to scan my PC. I thought that after the scan is completed the program will stop, but I was wrong. Then there were those annoying messages that popped up here and there. I closed them, but they appeared again.

 

I really want to remove this tool. I believe it is fake because it always insists on making me buy its license. Please, let me know if you have some idea how to get rid of this program.

[KenB]

Hi and welcome to ExTS

 

Download MBAM from here:

click here

 

Install > Update and then run it.

It will produce a log in Notepad

Copy this and paste it here please.

[Starbuck]

Live Security Platinum may also change your Internet options to include a proxy.

Your .exe files may also be effected...... so MBAM may not be able to be downloaded and run.

 

Here's the quick way to get you sorted.

There's an excellent guide to removing this malware here:

http://www.bleepingcomputer.com/virus-removal/remove-live-security-platinum

 

Let us know how you get on and if there's any problems, we'll be able to help out.

[primavera]

Thanks so much for your help! Well, I read your information and I also found this americanpendulum.com/de/2012/07/11/live-security-platinum-virus-how-to-remove. However, I decided to use Malwarebytes and I scanned my PC using it. Then it detected Live Security Platinum and classified it as a virus and serious computer threat. The next thing I did was to use the program I had installed and remove the infection, I think it worked, because I don`t see the annoying pop-up messages anymore and there is no scary scan.

 

Thanks once again!

Edited July 26, 2012 by Starbuck

[Starbuck]

Hi primavera,

 

I'm glad you got sorted.

 

I've killed the link you posted.

It doesn't get a very favourable report from WOT: ( in fact it's quite a bad report)

I seriously suggest you stay away from that site.

 

I think it worked, because I don`t see the annoying pop-up messages anymore and there is no scary scan.

It is possible that there may be a few orphan entries in your registry, plus there may be leftovers from the infection.

If you want us to take a look for you, just follow the step below.

 

• Download OTL to your desktop.
  If using Firefox ..right click on the link and select 'Save Link/Target As'.
   
  if you have problems, try this download link:
  OTL
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check

.

 

.

http://img.photobucket.com/albums/v708/starbuck50/new/Otllatest.png

 

Now copy the lines in bold below.

 

netsvcs

msconfig

%SYSTEMDRIVE%\*.*

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\*

%USERPROFILE%\..|smtmp;true;true;true /FP

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

CREATERESTOREPOINT

 

• right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.
   
  http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
  .
  
• Click the Run Scan button.
   
  http://img.photobucket.com/albums/v708/starbuck50/runscan.png
   
  
• Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.