How to safely remove FAKE Antivirus 360

*IMPORTANT: Fake software can be removed without having to purchase any removal software. Also, you do NOT need to WIPE your hard drive and reinstall the Windows operating system.

We searched the web for a fix to our problem – couldn’t find one for antivirus 360. Here were the symptoms we identified on a PC:

  • Windows registry would only stay open for 10 seconds
  • Windows CMD would not open
  • Anti-virus and Firewall were disabled and removed
  • Windows Security Center disabled – you don’t see the shield
  • Browser redirected to malicious websites
  • Not able to download or update ANY security products

We suggest you use Malwarebytes which does a great job of removing most of the malicious files. Before you install Malwarebytes (or any security software including being able to download windows updates) you need to search for and remove the following entries, otherwise Malwarebytes (or any other security software) will not work properly, download or install:

  • Winconfig.dll
  • A360.exe
  • Winsystems.dll
  • DELETE all files in the “PREFETCH” folder

On deletion of the above files, you can now download and install Malwarebytes.

TIP: We couldn’t update so we had to update the database manually. Click here for manual download.

Here are the keys, data items, files and folders that you should remove:

Registry Keys Infected:


CurrentVersion\Explorer\Browser Helper Objects\{d263fa6d-84cc-48a8-9af6-c664362b7a5b}




Registry Data Items:

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter)

Folders Infected:

A360 (Rogue.A360Antivirus)

Files Infected:





Microsoft\Internet Explorer\Quick Launch\A360.lnk


C:\WINDOWS\system32\UACftdrxsnm.dll C:\WINDOWS\system32\UACpulqeavn.dat C:\WINDOWS\system32\UACrtaxtmsn.log

On completing this scan/removal and rebooting Malwarebytes you should now be able to update automatically (and other security software including windows update should now be ok too)

Installing Antivirus and a Firewall

You should now install your antivirus (this will also activate the appropriate product updates as well as Windows Security updates – you should now see the Windows Security Shield in the TASK BAR).

We use avast! – download, install and run a boot scan (it will prompt you to do this after installation) which should find these infected files:

C:\documents and settings\user\local settings\Pgmm.ltm [Trojan]

C:\DOCUME~1\user\LOCALS~1\PGMM.LTM [Trojan]




You will be advised to restart your PC.

Having restarted your PC you will now need to download and install a Firewall. We recommend ZoneAlarm and it is 100% FREE!

For added assurance I suggest you download Spyware Terminator. It’s 100% FREE and will monitor every action. It also comes with a handy ‘Safe Web Search’ tool which places a GREEN shield next to safe websites.

Lastly you will need to update Windows Security. Click here.

* Be very careful when making any changes to the Windows Registry. We suggest you make a Windows Registry backup before making any changes.

Click here to learn more about the threats you face when shopping online.

Safe surfing folks!


This entry was posted in anti-virus. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *