Sagate.exe (GAOBOT.BOW WORM)
Sagate Security Firewall should not be running at startup. It is likely a virus, spyware, trojan, or some other sort of malicious program. Use a virus scanner, and/or spyware removal tool to remove it. Added by the GAOBOT.BOW WORM
Level of Danger: High
Distribution Level: Medium

Removal Tools:
Killbox
KillBox is a tool to delete in-use files, if the file is running, KillBox will attempt to end the process (close the running file) and delete it.

Download KillBox
Download KillBox Beta
Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
When turning on the pc/Restart your Computer, repeatedly Press F8 key when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names

• WINDOWS\System32\awtsr.dll
• WINDOWS\System32\mljii.dll
• WINDOWS\System32\sagate.exe
• WINDOWS\System32\dflnl.exe
• Program Files\MediaGateway\MediaGateway.exe
• WINDOWS\fwnet64.exe

Download the program KillBox and decompress.
Starting the KillBox.exe and select the “Delete on reboot” (Delete to reboot).
In the box labeled “Full path of file to delete” (Full path of the file to delete).
There put the name of the file you want to delete and the path of where you are eg: if we want to delete the file sagate.exe and is located in the System32 folder put:
C:\WINDOWS\System32\sagate.exe
Then press the button that looks like a red circle with a white X. When asked whether you want to reboot now ( “Reboot now”), which put Yes (SI).

If we have more than one file or folder to eliminate, this time we are going to use the following steps:
Run Killbox and select:
“Delete on reboot” (Delete to reboot)
“All Files” (All Files)
Copy all the files that are going to be to eliminate, for example:
C:\WINDOWS\System32\sagate.exe
C:\WINDOWS\System32\sagate2.exe
C:\WINDOWS\System32\sagate3.exe
and paste it into the “Full Path of File to Delete”
Go to menu “File” and select “Paste from Clipboard” to add the rest of the files.
Clicking the button with a red circle and white X  ( “Delete File”), wait a moment and then accepts the message that appears (Your system will be rebooted)
After rebooting, a log.txt file located in C:\! Killbox\Logs, where you can check the results.
Manually Remove From Registry
Click Start; Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.
Navigate to the subkey:
Here, These are windows Startup Folders, Remove the entry of the file you untrust, Delete from Right Side only.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
In the right pane, delete the value:
“Sagate Security Firewall” = “sagate.exe”

Search Registry for More Entries, by using Find option in Edit Menu
Ctrl+F, Enter Keyword “sagate.exe” , then click Find. Remove all Entries that given above.

Exit the Registry Editor.
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

I’m posting this mostly for my brother ‘that mac guy’ that mentioned after reading a great review said he wanted to buy Spanning Sync but was too cheap.

But if there are other mac users out there reading my PC blog, I figured you might want to have at this deal too.

So, if you are going to buy Spanning Sync use this discount code for $5 off your purchase - GTMFRU.

Hat tip to Google Tutor.

Description of XP Antivirus 2009 (XPAntivirus 2009) and consequences of its residing on your PC

XP Antivirus 2009 may be downloaded from numerous sites pretending to be “official” sites. These sites often start scanning your PC without request. We must stress on that scanning is not the term to designate process called “online scan” at XP Antivirus 2009 sites. This process is just a screening of primitive cartoon pretending to reflect scan progress while any objects at your PC are not observed at all simply because XP Antivirus 2009 does not exist as a scanner.
Visiting sites promoting XP Antivirus 2009 is not a prerequisite to get this malware trial version installed. Remove XP Antivirus 2009, since this rogue may be installed with trojan. It is common knowledge that any trojan poses a challenge to the computer so remove XP Antivirus 2009 as this rogue may be installed with trojan.
XP Antivirus 2009 cannot be uninstalled at all; it simply has no such feature as there is no relevant entry in add/remove program list at Start Menu. Early version of XP Antivirus 2009 may have corresponding entry though, but if you choose to remove XP Antivirus 2009 the very next reboot will “restore” this program.
Click here and start free scan to detect this and other malware or viruses at your PC and to remove XP Antivirus 2009.

XP Antivirus 2009 (XPAntivirus 2009) Technical Details

• Full name: XP Antivirus 2009, XPAntivirus 2009, XPAntivirus2009
• Version: 2009
• Type: Rogue anti-spyware
• Origin: Russian Federation

XP Antivirus 2009 (XPAntivirus 2009) Screenshot (click to enlarge):

Signs of being infected with XP Antivirus 2009 (XPAntivirus 2009):

XP Antivirus 2009 usually automatically displays its window with various useless and harmless options and sections. The scan conducted by  XP Antivirus 2009 is now 100% fake; for fairness’ sake it is to say that early version of XP Antivirus 2009 comprises files responsible for creation harmless records in System Registry, then it  lists them as scan results, and one can pay for upgrade to the registered version capable to remove these harmless though real Registry entries.
XP Antivirus 2009 shows scaring alerts of two basic types. A message of first type starts with wording “Privacy violation alert!” and always comprises name Xp Antivirus. Message of another type always ends with “Click here to block unathorised modification by removing threats (Recommended)”. Text of alerts is cited without any correction.
It is easy to detect  XP Antivirus 2009 by repeated scan and frequent alerts, but it may be complicated to remove XP Antivirus 2009 and detect related threats. Click here  to start scanning computer and to remove XP Antivirus 2009 by daily updated malware removal tool.

Automatic Removal of XP Antivirus 2009 (XPAntivirus 2009) from your PC:

You might have noted from the above that XP Antivirus 2009 is very vital. Vital things are those able to change in right direction that ensures their survival. XP Antivirus 2009 has grown from old version comprising two times more files and at least removing something at victim’s computer to new version that can only pretend to remove something but is much harder for removal itself. Use updated tool to remove XP Antivirus 2009 following the link below.

Download XP Antivirus 2009 (XPAntivirus 2009) Removal Tool

Manual Removal of XP Antivirus 2009 (XPAntivirus 2009):

XP Antivirus 2009 belongs to XP malware family. This band is known for sharing XP brand name in denominating its members and strong ties within the group. By the other words, XP Antivirus 2009 may upload trialware of various rogues and trojans.  That is why complex automatic removal is preferable and recommended to remove XP Antivirus 2009 effectively.
However, the guide for XP Antivirus 2009 removal is developed not for the sake of appearance. You can remove XP Antivirus 2009 in any of its modes following precisely the instruction below, though we cannot ensure removal of all supporting programs with help of same instruction.
Reboot PC before and after procedure of XP Antivirus 2009 removal.

Remove XP Antivirus 2009 (XPAntivirus 2009) files and dll’s

xpa.exe
xpa2009.exe
av2009.exe
av2009[1].exe
AV2009Install.exe
XPAntivirus2009.exe
XP Antivirus 2009.lnk
Uninstall Antivirus.lnk
XPAntivirus2009.exe

Unregister XP Antivirus 2009 (XPAntivirus 2009) registry values:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ieupdate

XP Antivirus 2009 (XPAntivirus 2009) Remover with free scan