 | Home | | Download | | About | | Donation | | Forum | |
This guide contains three parts
Symptom of Rogue program AntiSpyware Soft
Antispyware Soft is known as a rouge antispyware program, it is another variant of the same family of "Antivirus Soft". It infects your computer without your permission or knowledge via a trojan program.
Symptom 1. Once this rogue program is active, it will disable your internet explore from accessing internet, thus you can not download any legitimate antispyware programs from internet. You can see the internet proxy server setting is configured to "127.0.0.1:5555" via Internet Options -> Connections -> LAN settings:
Symptom 2. One or two processes with random number name will appear in task manager:
This random process file is located in "Application Data" folder, the "Application Data" folder is :
For Windows XP : C:\Documents and Settings\%User Name%\Local Settings\Application Data
For Windows Vista/7 : C:\Users\%User Name%\AppData\Local
Note : %User Name% is the name you login.
Symptom 3. The following entries are added in registry so that the rogue program will be running automatically when Windows starts.
HKEY_LOCAL_MACHINE\Software\Microsoft\Window\CurrentVersion\Run\%Random Characters%:
C:\Documents And Settings\%User Name%\Local Settings\Application Data\%Random Characters%\%Random Characters%tssd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\%Random Character%:
Rundll32.exe "C:\Windows\System32\%Random Characters%.dll"
How to remove Antispyware Soft rogue program
Manual removal instructions
Step 1. Disable the internet proxy server setting by following the instructions below
Launch Internet Options, click Connections tab, then click LAN Settings, then uncheck the option Use a proxy server for your LAN..., click OK to exit internet options. Then you will be able to access internet via IE browser.
Step 2. Terminate all the Antispyware Soft processes using Task Manager
Launch Task Manager by pressing Alt-Ctrl-Del simotaniously, highlight these processes one by one and click End Process button.
- %Random Characters%tssd.exe
Step 3. Delete Antispyware Soft folder and files
Open My Computer and browse to %Application Data% folder:
For XP, the %Application Data% folder is C:\Documents and Settings\%User Name%\Local Settings\Application Data
For Vista/Win7, the %Applicaton Data% folder is C:\Users\%User Name%\AppData\Local
Find a subfolder whose name looks random, when you open that folder, an exe file with a random name but ended by tssd.exe, if you find this folder, delete it and all files in it.
Step 4. Delete registry entried added by Antispyware Soft rogue program
Click Start button at left bottom of your screen, then click Run, type in Regedit, in regedit window, navigate to this key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVerison\Run
Highlight the key Run, at right side, delete these value whose name looks random and whose value has these string : Application Data\%Random Characters%\%Random Characters%tssd.exe
Automatical Removal instructions
Several antispyware programs can completely remove this malware:
MalwareBytes:
MalwareBytes is an excellent antispyware program, The company of MalwareBytes provides a free version for personal user.
Download and install MalwareBytes Anti-malware (MBAM).
Main interface of MalwareBytes' Anti-Malware
AVG Antivirus:
AVG Antivirus is another well-known antivirus protection tool. The AVG Free Edition is available free of charge to home users for the life of the product.
Download and install AVG Free Edition
Main interface of AVG
Solution for infection by a new variant
If you followed the steps above but still get this malware or some objects are denied to delete, your computer possibly gets infected by a new variant or there is some hidden objects that have not been detected. We provide a free diagnostic scan tool ("TheStubware") to scan your computer and generate a scan log file for analysis. This tool is especially used to find those stubborn malware. You can submit your log file to support@TheStubware.com, we will analyze it and send you back a removal script file to remove the new variant or hidden objects found in your log file.
Download and install TheStubware
| Do you remove this: |