Jun 10, 2012

Infected by Rapid Antivirus (RapidAntivirus 2.7) Rogue? Manual Removal Instruction

Has your computer been infected with Rapid Antivirus rogue and required money to purchase the full version? Have you failed to get rid of it after trying lots of methods? This fake anti-spyware program should be removed manually and immediately before more dangerous consequences happen.

What is Rapid Antivirus Rogue:

Rapid Antivirus also known as RapidAntivirus 2.7, is a nasty anti-spyware application targeting at vulnerable computer users worldwide. This scam has a trustworthy look as other fake antivirus programs and pretends to be a legitimate PC system protection software. But the intention is always the same which is to get your money out of your pockets to purchase the full version so that it can provide an overall caring for your computer. It is said to be an Internet crime that has been quite popular in these days.

The most popular way to be infected by Rapid Antivirus fake software is via the help of Trojans in system backdoor activities. Besides from that, opening scam emails or downloading unknown programs can also lead to the infection. It will boast to you that it can help to remove malwares and viruses found in your computer, optimize and speed up your computer system and provide good protections in the future. Once being infected, Rapid Antivirus software will appear each time after you reboot the computer as it has changed the related settings of the system. It will then automatically run a fake scan through your computer as soon as the reboot is done. Then it states your computer is full of critical errors, viruses and malwares. But none of the above truly exists. By saying that, it tries to encourage you to buy its license version as this is the only option it gives to help you stop these annoying pop-ups. But even if you do make the payment, it is not only useless in removing those viruses, but may cause a lot more damages to your system. Therefore, it is the best option to not believe in it and to realize that it should be removed immediately without any doubt.

Screen Shot of RapidAntivirus

RapidAntivirus Scan

Fake Security Alerts Examples

Warning
Firewall has blocked a program from accessing the Internet
C:\programs files\Internet Explorer\iexplore.exe
Is suspected to have infected your computer. This type of virus intercepts entered data and transmits them to a remote server.
Error
Attempt to modify Registry key entries detected.
Registry entry analysis recommended.

Some Consequences to Notice

1. Other spywares and viruses will be installed without your permission;
2. Personal privacy will be captured by remote hosts to make a profit out of it;
3. Icons from both the desktop and the Start menu may be disappeared;
4. Significant files, folders, system data will be hidden from you to find;
5. Your computer will be slowed down and occurring constant sudden deaths.

Manually Remove Rapid Antivirus Scam Step by Step

Normally this kind of rogue needs to be removed manually as it cannot be 100% removed by antivirus programs. In case any mistake happens during the manual removal processing, you are supposed to do a backup of important things at first. Then follow the steps given below:

1. Reboot the infected computer, repeatedly press F8 key before the Windows Start up screen shows up, use arrow keys to select “Safe mode with networking” and press Enter;
2. Press Ctrl+Alt+Del to open the Windows Task Manager;
3. End the process Rapid Antivirus .exe;
4. Find out and delete all these associating files:
%AppData%\NPSWF32.dll
%AppData%\Protector-[Rapid Antivirus].exe
%AppData%\result.db
%AppData%\Protector-.exe
%AppData%\Protector-.exe
%CommonStartMenu%\Programs\Rapid Antivirus .lnk
%Desktop%\Rapid Antivirus .lnk
5. Find out and remove all these associating registry entries:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Regedit32
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\{Rapid Antivirus}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\