Free Fake Antivirus Removal Software Updated

Martin Brinkmann
Oct 31, 2011
Updated • Apr 1, 2012
Antivirus, Software, Windows, Windows software

Fake antivirus software has been on the rise in the past years. The term refers to malware that disguises itself as system protection software. Some of those programs fake malware infections to lure the user into buying an upgrade to remove the non-existing threats on the system. Others are plain malicious in nature or are disguised as official antivirus solutions from well known companies such as AVG, Microsoft or BitDefender.

The biggest advantage for attackers when it comes to fake antivirus software is that users install the software by themselves on their systems. There is no need to exploit a security vulnerability or hack a PC, all that is needed is a legitimately looking website that offers the fake security software for download.

I reviewed the Remove Fake Antivirus software for the first time back in 2009. Back then it offered to remove 27 different fake antivirus suites and programs from a Windows system.

fake antivirus removal

A new version of Remove Fake Antivirus has been released today, bringing the version of the program to 1.81. More important than that is that the program is now supporting a total of 74 fake antivirus programs.

All that needs to be done is to run the portable software on an infected system to remove any of the supported antivirus programs.

remove fake antivirus

A click on Start scans the system for fake antivirus processes and files. The program cleans everything automatically after scanning system directories (including windows, winsxs and the user profile folders) and known fake antivirus directories thoroughly.

The scan may take some time depending on the speed of the computer and the hard drives. It may be required to reboot the computer if fake antivirus software has been found on the system.

Here is the list of fake antivirus software that the software can remove.

  • Data Recovery
  • Wolfram Antivirus
  • Security Protection
  • Windows Antivirus 2011
  • Mega Antivirus 2012
  • AVG Antivirus 2011
  • PC Security 2011
  • ThinkPoint
  • ThinkSmart
  • Antivirus 8
  • Security Tool
  • My Security Shield
  • Antivirus 7
  • Antivirus GT
  • Defense Center
  • Protection Center
  • Sysinternals Antivirus
  • Security Master AV
  • CleanUp Antivirus
  • Security Toolbar
  • Digital Protection
  • XP Smart Security 2010
  • Antivirus Suite
  • Vista Security Tool 2010
  • Total XP Security
  • Security Central
  • Security Antivirus
  • Total PC Defender 2010
  • Vista Antivirus Pro 2010
  • Your PC Protector
  • Vista Internet Security 2010
  • XP Guardian
  • Vista Guardian 2010
  • Antivirus Soft
  • XP Internet Security 2010
  • Antivir 2010
  • Live PC Care
  • Malware Defense
  • Internet Security 2010
  • Desktop Defender 2010
  • Antivirus Live
  • Personal Security
  • Cyber Security
  • Alpha Antivirus
  • Windows Enterprise Suite
  • Security Center
  • Control Center
  • Braviax
  • Windows Police Pro
  • Antivirus Pro 2010
  • PC Antispyware 2010
  • FraudTool.MalwareProtector.d
  • Green AV
  • Windows Protection Suite
  • Total Security 2009
  • Windows System Suite
  • Antivirus BEST
  • System Security
  • Personal Antivirus
  • System Security 2009
  • Malware Doctor
  • Antivirus System Pro
  • WinPC Defender
  • Anti-Virus-1
  • Spyware Guard 2008
  • System Guard 2009
  • Antivirus 2009
  • Antivirus 2010
  • Antivirus Pro 2009
  • Antivirus 360
  • MS Antispyware 2009
  • IGuardPC or I Guard PC
  • Additional Guard

The portable nature of the application makes it a great addition to a PC technicians toolbox. Have you ever encountered fake antivirus software? How did you resolve the infection?

Windows users can download the latest version of Remove Fake Antivirus from the developer website.


Tutorials & Tips

Previous Post: «
Next Post: «


  1. G West said on November 7, 2011 at 9:05 pm

    Have a fake program…Privacy Exec, from Jet Brains s.r.o version 6.3.3100.14903 and name of Yyigiu.ocx and file name of Dha.ocx. I got it when I down loaded the free version of Avast…which I found based on the 5 best consumer rated plans. Now I am basically locked out of running any programs on my PC…Internet, Taskmaster,….. will this removal program take care of this…I keep gettint that all my programs are infected with; w32/blaster.worm virus…and of course told I have to purchase the full version of this anti virus protection program.

  2. Patricia Campo said on November 1, 2011 at 4:00 pm

    I got the fake antivirus removal bug 3 times on 2 different laptops and each time it was named something different. Something that looked really official. My question is if I download this removal tool now when I dont have the bug, will I be able to run this software if I do happen to get the fake again? I know when you get it it blocks you from clicking or running anything.

    1. Martin Brinkmann said on November 1, 2011 at 4:05 pm

      Patricia, that depends on the fake antivirus installed on your system. I’d guess that the majority would allow the program while some might block it. It is definitely worth a try though.

  3. Jojo said on November 1, 2011 at 7:52 am

    Does not work for me! This is what I get:

    The 2nd small window I captured here is the detail window. I can’t even see the name of the supposed virus I have in the title bar.

    And there does not appear to be any log written.

    AND I am confident that I do not have any fake AV program installed.

    1. Martin Brinkmann said on November 1, 2011 at 9:26 am

      Jojo it is always displaying that message before it starts the scan. It is not a confirmation that a virus is on your computer.

  4. TechBuzzard said on October 31, 2011 at 8:56 pm

    When did AVG Antivirus became fake?

    1. Arturus said on November 1, 2011 at 2:18 pm

      The real AVG will not be a popup telling you to click to download it. You have to actually manually download it from the website.

      BTW, some of these fakes also masquerade as updates (Windows, Adobe, antivirus etc) so always actually read what popups say instead of just clicking them to get rid of them.

    2. Martin Brinkmann said on October 31, 2011 at 9:11 pm

      It is not an official version made by AVG, it is a fake.

  5. Jim said on October 31, 2011 at 6:29 pm

    Thanks for this. I was hit by one of these a few years ago and it was a serious pain to get rid of. Once they pop up it is too late. The “OK”, “Cancel”, and red “X” all do the same thing. Heck, it might even be installing itself before then. Even though I run an array of anti-malware tools, it blew right past all of them.

    I had a close encounter with a similar nasty this weekend. I opened my Yahoo mail and the first email was a list of Facebook friends with birthdays this week. When I opened it another tab opened up telling me I had won a giftcard. I was supposed to pick one from 3 or 4 choices. I killed the browser instead. I was running Chromium on a Linux system. I checked everything I could think of and couldn’t find any signs of it anywhere. I did a little checking on the web and it appears to be similar to the fake AV pop-ups. Pretty nasty. Also saw some mentions of others getting it from FB.

    Anyone else encounter this? Any ideas for how to check a Linux system to make sure it isn’t contaminated?

    1. SubgeniusD said on November 1, 2011 at 5:26 am

      Re: Conatminated Linux systems – You can get this from your repo or d/l it here –

      It sounds like some sort of browser exploit. I listen to the Sophos security podcast every week –
      – and these are almost all designed to attack Windows systems with a few targeting Macs.

      The bad guys figure Linux users are a bunch of students and poor cheapskates who don’t have enough in the bank to bother with LOL.

    2. SubgeniusD said on November 1, 2011 at 5:14 am

      You’re saying that the popup was in the body of the email itself? Like a short piece of javascript? On the Yahoo server? Or is this a POP account?

      Yahoo Mail has good filters. A friend of mine who is both tech-challenged and browser-reckless had his Yahoo account hacked and I just got another phony message from that account a few minutes ago.

      In every case the intent is to get you to click an external link to go to an infected site. I’ve never seen any sort of email popup in 7 years of Yahoo Mail (Yahoo Plus).

      1. Jim said on November 1, 2011 at 7:13 pm

        No. Everything was operating normally until I opened the email from FB. That’s when the popup appeared. I suspect it was either in the email or in the remote content, not Yahoo.

  6. Midnight said on October 31, 2011 at 5:39 pm

    Good Tool to have, not that I ever get those silly and dangerous things!
    KIS 2012 makes sure of that! :)

  7. Mike J said on October 31, 2011 at 4:07 pm

    I forwarded this to a lot of folks I know. Thanks.

    1. Martin Brinkmann said on October 31, 2011 at 4:25 pm

      Thanks for that Mike ;)

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.