Antivirus 360 is latest rogue anti-spyware program which uses scare tactics to promote itself using terrible false scan results, pop-ups, security alerts e.t.c.
Antivirus 360 uses Vundo Trojan in order to install itself on your computer without any informing and approval. Once installed Antivirus 360 will configure itself to run automatical scan each time you turn on your computer. Once you turn on your computer, Antivirus 360 will say that it is seriously infected with different types of malware. Moreover, Antivirus 360 states that legitimate Windows files are “dangerous threats”. And the only way to remove all detected trash is to purchase licensed version of this pseudo-security software. Also Antivirus 360 may put your data and privacy on risk. So we recommend you to remove Antivirus 360 manually or using our removal tool (Spyware Doctor + antivirus).

Type: Rogue Anti-Spyware
Malware Author: Unknown
Threat Level: Critical

Screenshot:
How to remove Antivirus 360 manually:
It's possible to remove Antivirus 360 manually , but you have to be very experienced in dealing with registry entries, program files and .dll files.


The files to be deleted:

* %Program Files%\A360\av360.exe
* %UserProfile%\Desktop\Antivirus 360.lnk
* %UserProfile%\Start Menu\Antivirus 360\Help.lnk
* %UserProfile%\Start Menu\Antivirus 360\Registration.lnk
* %UserProfile%\Start Menu\Antivirus 360\Antivirus 360.lnk
* %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk

Remove registry entries:

* HKEY_CURRENT_USER\Software\13376694984709702142491016734454
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “13376694984709702142491016734454?

Please be careful because manual removal of Antivirus 360 may seriously damage operational system and sensitive data. Also there is a big possibility of incomplete removal, because some files could be hidden and program could re-install itself after you delete files and registry entries. -="-?item=11719-8&.&linkid=mraav360">-.

Good day, Paul Cooke here.

It’s great to be hosting the all new Windows Security Blog. For the last couple of years, we have been talking about what has made Windows Vista the most secure client operating system Microsoft has ever delivered over on the Windows Vista Security Blog. Now, as we start talking about Windows 7 and look for opportunities to discuss relevant security topics in a broader sense, we felt it was a good time to re-launch and re-locate the blog here as part of the Windows Blog.

The purpose of this blog is to make you aware of all the things that go into having a secure Windows environment. This will cover the gamut from Windows XP all the way through the upcoming Windows 7. We plan to post updates regularly and add some variety with guest posters throughout the security space here at Microsoft.

No matter if you are making the move from our old Windows Vista Security Blog or you are joining us for the first time, we welcome you and look forward to your comments. We will work hard to carry on great discussions with all of you!

You may have noticed a new blog has appeared under the menu of our site today. I’d like to welcome Paul Cooke, who is a Director here at Microsoft, to our site. Paul and his team will be running the Windows Security Blog – which is what you could consider the successor to the Windows Vista Security Blog. I am really excited about the addition of the Windows Security Blog to our site as I know many readers are very interested in Windows Security. Look for a post from Paul soon!

Manual Removal of W32/AutoIt.HI Trojan

Damage Level : High/Medium
Distribution Level: Unknown
There is NO Auto Removal Tool for W32/AutoIt.HI Trojan
Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.
The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %System32\csrcs.exe

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg

Manually Remove From Registry 
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
csrcs.exe
_+ Any of the Above Listed Files +_

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Manual Removal of W32/UltimateAntivirus.CQ Trojan

Damage Level : High/Medium
Distribution Level: Unknown
There is NO Auto Removal Tool for W32/UltimateAntivirus.CQ Trojan
Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.

The trojan installs itself as a software and scans the system. Once scanning is completed it takes to a website for registration

Shows Warning ” Antivirus 2009 is Inable, Need to be Licensed, It will Cheat You and Force you to buy license.

The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• %System32\MicroAV.cpl
• %Program Files\Micro Antivirus 2009\MicroAV.exe
• %Documents and Settings\Bleeping\Desktop\Ultimate Antivirus.lnk
• %Program Files\UAV
• %Program Files\UAV\uav.cpl
• %Program Files\UAV\uav.exe
• %Program Files\UAV\uav0.dat
• %Program Files\UAV\uav1.dat
• %WINDOWS\system32\uav.cpl
  

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg

Manually Remove From Registry 
Click Start, Run,Type regedit,Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.
HKEY_CLASSES_ROOT\.key
HKEY_CURRENT_USER\Software\AntiVirus
HKEY_CURRENT_USER\Software\UAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
“Antivirus”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
“Antivirus”

_+ Any of the Above Listed Files +_

Exit the Registry Editor,
Restart your Computer.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Killbox (Freeware)

Mary Jo Foley of All About Microsoft talks about Microsoft discontinuation of Digital Locker, Vista’s built in storage management solution for software titles and product licensing bought through Windows Marketplace.

Quote : Microsoft has sent a note on December 11 to registered Marketplace customers alerting them of its plans to discontinue Digital Locker. From the note:

Dear Digital Locker Customer,

This is to notify you that on November 20, 2008 Windows® Marketplace  transitioned from an e-commerce site to a reference site. On Windows Marketplace you will find links to sites such as Microsoft Store, Windows Vista® Compatibility Center, and other destinations with compatible software, hardware and devices that support Microsoft platforms.  As part of this transition, the digital locker service affiliated with Windows Marketplace will be closed in August, 2009.

Read the entire post here

I personally have never used the service, but it seemed like a good idea. I don’t know if Microsoft is working on anything better. But the link to Digital Locker usually found under the Task Pane in Programs and Feature in Vista is not available in Windows 7, so it looks like this decision was made a long time ago.

Resources:

Windows Marketplace Frequently Asked Questions page.