Antivirus AntiSpyware 2011

Antivirus AntiSpyware 2011 is a fake security software (rogue). It replaces Security essentials 2011, Security essentials 2010, Internet Security 2010 and Advanced Virus Remover.



Antivirus AntiSpyware 2011 displays a lot of warning messages, change the desktop background, detects fake infections and blocks softwares execution. It comes from fake online scanners, malicious porn sites, fake cracks and exploits.

To register (and help removal), copy paste this code: AAS17-F7D9M-G3B2A
Thanks to Xylitol

If your PC is infected with Antivirus AntiSpyware 2011, use MBAM to remove the infection.
Thanks Code Hunter

Security essentials 2011

Security essentials 2011 is a fake security software (rogue). It replaces Security essentials 2010, Internet Security 2010 and Advanced Virus Remover.



Security essentials 2011 displays a lot of warning messages, change the desktop background, detects fake infections and blocks softwares execution. It comes from fake online scanners, malicious porn sites, fake cracks and exploits.

If your PC is infected with Security essentials 2011, use MBAM to remove the infection.

Antivirus (AnVi)

Antivirus (AnVi) is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Antivirus (AnVi) also detects non existent infections to scare users. It is from the CoreGuard family (Defense Center, Protection Center, Data Protection, Digital Protection, Your Protection, User Protection, Dr. Guard, Paladin Antivirus).



If your PC is infected with Antivirus (AnVi) use MBAM to remove the infection.

Defense Center

Defense Center is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Defense Center also detects non existent infections to scare users. It is from the CoreGuard family (Protection Center, Data Protection, Digital Protection, Your Protection, User Protection, Dr. Guard, Paladin Antivirus).



If your PC is infected with Defense Center use MBAM to remove the infection.

Protection Center

Protection Center is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Protection Center also detects non existent infections to scare users. It is from the CoreGuard family (Data Protection, Digital Protection, Your Protection, User Protection, Dr. Guard, Paladin Antivirus clone).



If your PC is infected with Protection Center use MBAM to remove the infection.

Data Protection

Data Protection is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Data Protection also detects non existent infections to scare users. It is from the CoreGuard family (Digital Protection, Your Protection, User Protection, Dr. Guard, Paladin Antivirus clone).



If your PC is infected with Data Protection use MBAM to remove the infection.

Digital Protection

Digital Protection is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Digital Protection also detects non existent infections to scare users. It is from the CoreGuard family (Your Protection, User Protection, Dr. Guard, Paladin Antivirus clone).



If your PC is infected with Digital Protection use MBAM to remove the infection.

Your Protection

Your Protection is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Your Protection also detects non existent infections to scare users. It is from the CoreGuard family (User Protection, Dr. Guard, Paladin Antivirus clone).



If your PC is infected with User Protection use MBAM to remove the infection or follow Bleeping Computer's removal guide.

Thanks to Miekiemoes

User Protection

User Protection is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. User Protection also detects non existent infections to scare users. It is from the CoreGuard family (Dr. Guard, Paladin Antivirus copycat).



If your PC is infected with User Protection use MBAM to remove the infection or follow Bleeping Computer's removal guide.

Dr. Guard

Dr. Guard is a fake security application. This rogue prevents legit softwares execution, displays fake alerts and warning messages. Dr. Guard also detects non existent infections to scare users. It is from the CoreGuard family (Paladin Antivirus copycat).

The rogue contain Malwarebytes MBAM database, but Dr. Guard is unable to work with it as the engine is not optimized to use the stolen data.



If your PC is infected with Dr. Guard use MBAM to remove the infection or follow Bleeping Computer's removal guide.

Thanks to Malekal Morte.

Security essentials 2010

Security essentials 2010 is a fake security software (rogue). It replaces Internet Security 2010 and Advanced Virus Remover.



Security essentials 2010 displays a lot of warning messages, change the desktop background, detects fake infections and blocks softwares execution. It comes from fake online scanners, malicious porn sites, fake cracks and exploits.

If your PC is infected with Security essentials 2010, use MBAM to remove the infection.

Paladin Antivirus

Paladin Antivirus is a fake security application (rogue) from the CoreGuard family.

Paladin Antivirus detects fake infections on a clean system to scare users. It also prevent legit softwares execution, displaying an alert/infected message.
The rogue contain Malwarebytes MBAM database, but Paladin Antivirus is unable to work with it as the engine is not optimized to use the best of the stolen data.

Licensing the software and clicking [Check for Updates] button launch an animation but there is no network activity.



If your PC is infected with Paladin Antivirus use MBAM to remove the infection.

Internet Security 2010

Internet Security 2010 is a fake security software (rogue). It replaces Advanced Virus Remover.



Internet Security 2010 displays fake infections to incite users into buying a license. It also blocks softwares execution displaying an error message:

Application cannot be executed. The file is infected. Please activate your antivirus software.

Internet Security 2010 comes from fake online scanners and malicious porn sites using exploits to run a Trojan Downloader.

The Trojan Downloader also displays many fake errors. When running some media player process (QuickTimePlayer.exe, AdvancedDVDPlayer.exe, tvp.exe, realplay.exe, windvd.exe, winamp.exe, setup_wm.exe, LA.exe, PowerDVD.exe, mplayerc.exe, wmplayer.exe) it displays an error message and redirects to vs-codec-pro.net (193.104.110.50) page.

Windows can`t play the folowing media formats: AVI;WMV;AVS;FLV;MKV;MOV;3GP;MP4;MPG;MPEG;MP3;AAC;WAV;WMA;CDA;FLAC;M4A;MID. Update your video and sound codec to resolve this issue.

advanced-virus-remover-2009.com (193.104.110.50)
advanced-virusremover-2010.com (193.104.110.50)
advanced-virusremover2009.com (193.104.110.50)
advancedvirus-remover-2010.com (193.104.110.50)
advancedvirusremover-2010.com (193.104.110.50)
avrdownnew5.com (193.104.110.50)
avrdownnew6.com (193.104.110.50)
avrdownnew7.com (193.104.110.50)
avrdownnew8.com (193.104.110.50)
avrdownnew9.com (193.104.110.50)
buy-internet-security2010.com (193.104.110.50)
buy-internetsecurity-2010.com (193.104.110.50)
buy-internetsecurity2010.com (193.104.110.50)
buyinternet-security-2010.com (193.104.110.50)
buyinternet-security2010.com (193.104.110.50)
coolcount1.com (193.104.110.50)
downloadavr13.com (193.104.110.50)
downloadavr14.com (193.104.110.50)
downloadavr15.com (193.104.110.50)
downloadavr20.com (193.104.110.50)
downloadavr7.com (193.104.110.50)
greatcrypt.com (193.104.110.50)
pc-scanner-2010.com (193.104.110.50)
pc-scanner-2010.org (193.104.110.50)
pc-scanner-2011.biz (193.104.110.50)
pc-scanner-2011.com (193.104.110.50)
pc-scanner-2011.org (193.104.110.50)
pc-scanner-2012.net (193.104.110.50)
pc-scanner-2012.org (193.104.110.50)
pc-scanner2010.com (193.104.110.50)
pc-scanner2010.net (193.104.110.50)
pc-scannerr.us (193.104.110.50)
pcscanner2010.org (193.104.110.50)
scanner-pc-2010.net (193.104.110.50)
testavrdown.com (193.104.110.50)
vs-codec-pro.net (193.104.110.50)
vsproject.net (193.104.110.50)
white-xxx-tube.com (193.104.110.50)
white-xxxx-tube.net (193.104.110.50)
xxx-white-tube.net (193.104.110.50)

If your PC is infected with Internet Security 2010, follow the BleepingComputer removal guide.

Active Security

Active Security is a fake anti-malware software. It is a clone (same family) as PC Scout, Protection System, CoreGuard Antivirus 2009.



This family tries to remove legit security softwares and displays alerts about unauthorized antivirus softwares.

PC Scout

PC Scout is a fake anti-malware software. It is a clone (same family) as Protection System, CoreGuard Antivirus 2009.



This family tries to remove legit security softwares and displays alerts about unauthorized antivirus softwares.

Protection System rogue

Protection System is a fake anti-malware software, clone of CoreGuard Antivirus 2009.



Sunbelt blog reports (thanks to Patrick Jordan) Protection System detects Malwarebytes MBAM installation. The rogue runs MalwareBytes uninstaller to remove the protection.



CoreGuard Antivirus 2009 was also uninstalling MBAM:


The rogues removes the legit AntiMalware to confuse users and protect itself from being detected.

Protection System steal MBAM database version 2551. Of course, if the database is used by the rogue, the engine is not the same and can only use a small part of it to its advantage.

Advanced Virus Remover

Advanced Virus Remover Rogue displays fake infections to incite users into buying a license.



Notice the shared IP with VSCodec Pro and other rogues:

antivirus-scan-2009.com (91.212.65.29)
vs-codec-pro.com (91.212.65.29)
vscodec-pro.com (91.212.65.29)
alltubesplace.com (91.212.65.29)
antivirus-xppro2009.com (91.212.65.29)
onlinescanxpp.com (91.212.65.29)
antivirus-pppro.com (91.212.65.29)
antivirus-xppro-2009.com (91.212.65.29)

CoreGuard Antivirus 2009

CoreGuard Antivirus is a new fake security scanner (rogue).



Stay away from these sites:
bitcoreguard.net (72.232.187.197)
bitcoreguard.com (72.232.187.197)
guardlab.com (72.232.187.198)
guardav.com (72.232.187.198)
coreguard2009.com (78.46.151.181)
coreguard2009.biz (78.46.151.181)
coreguard2009.net (78.46.151.181)
coreguardlab2009.biz (95.211.14.161)
coreguardlab2009.net (95.211.14.161)
coreguardlab2009.com (95.211.14.161)
guardlab2009.biz (76.76.103.164)
guardlab2009.net (76.76.103.164)
guardlab2009.com (76.76.103.164)

BleepingComputer CoreGuard Antivirus 2009 removal guide.
Thanks to MAD