Live Enterprise Suite Rogue Anti-Spyware - removal guide

Live Enterprise Suite

Created: 2010-01-27 04:25:13 Author: Gaby C.

Information about Live Enterprise Suite

Stay away from Live Enterprise Suite application. It’s a rogue program that spreads through the use of spyware and fake anti-spyware scanners online. If installed, LiveEnterpriseSuite disables Task Manager at first, so that you cannot terminate any processes of this parasite and the program can successfully work on its major purpose. It’s not difficult to guess that the main thing Live Enterprise Suite was created for is to steal computer users’ money. Just like most of the rogue anti-spyware Live Enterprise Suite attempts to convince people to purchase its license.

Live Enterprise Suite is related to TDL3 rootkit which complicates the removal of this malware even more. Manual removal using Safe Mode may not work in this particular case. So if you are not experienced enough leave the removal of Live Enterprise Suite to an expert or get rid of it with an anti-spyware program. If you remove some wrong files, it may do some damage to your Operating System.
Typically to many rogue anti-spyware, Live Enterprise Suite automatically scans your computer and generates lists of infections that according to Live Enterprise Suite can only be removed after you purchase a full version of a program. Constant display of security alerts and pop up ads stating about spyware detected on your system is another sign typical to Live Enterprise Suite application. Just like the scan results they must be ignored.

In any case, do not purchase Live Enterprise Suite as you will only make profit for cyber criminals and get nothing in return. If you have already made a payment for this program, immediately contact you credit card company and dispute the charges. Then use the removal guide below or remove Live Enterprise Suite with a reputable anti-spyware program.

Live Enterprise Suite Facts

For automatic Live Enterprise Suite removal, please download Spyware Doctor:

Spyware Doctor

Live Enterprise Suite pretends to increase security of your PC
Live Enterprise Suite free version will show popups, alerts and fake results to convince you to pay
Live Enterprise Suite creators will not deliver license keys upon paying or the full version will not be functional
Live Enterprise Suite might be used to download and advertise other malicious software
Live Enterprise Suite might disable some of your PCs or its programs functions

Manual Live Enterprise Suite removal instructions

Note: Manual removal of parasite Live Enterprise Suite is tedious and dangerous task if done incorectly. Stoping and deleting incorrect executables and DLLs, deleting registry entries might harm your PC. Thus we recommend using Spyware Doctor of PCTools for automatical scan and removal of computer parasites, or another reputable spyware remover.

1

Kill malicious Processes:

How to kill malicious processes

unins000.exe
winlogon.exe
services.exe
atbyin.exe
[random path]char.exe
IAPro.exe

2

Unregister malicious Dlls:

How to unregister malicious DLLs

WMILib.dll
[random path].dll

3

Remove malicious Registery entries:

How to remove malicious registry entries

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe "Debugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe "RealDebugger"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\567 1.4.2.0_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Enterprise Suite_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HTGRDENGINE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTGrdEngine
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTGRDENGINE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTGrdEngine
HKEY_CURRENT_USER\Software\Microsoft\FTP "SearchDir" = "c:\program files\Internet Antivirus Pro\"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "[random]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Live Enterprise Suite"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft Windows logon process"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION "svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent "URIAPRO[]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent "URIAPRO[]"

4

Remove harmful Files:

How to remove harmful files

%UserProfile%\Application Data\Live Enterprise Suite
%UserProfile%\Application Data\Live Enterprise Suite\settings.ini
%UserProfile%\Application Data\Live Enterprise Suite\uill.ini
%UserProfile%\Application Data\Live Enterprise Suite\unins000.exe
%UserProfile%\Application Data\Live Enterprise Suite\updateloadlist.ini
%UserProfile%\Application Data\Live Enterprise Suite\db
%UserProfile%\Application Data\Live Enterprise Suite\db\config.cfg
%UserProfile%\Application Data\Live Enterprise Suite\db\Timeout.inf
%UserProfile%\Application Data\Live Enterprise Suite\db\Urls.inf
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Antivirus Pro.lnk
%UserProfile%\Application Data\Microsoft\Windows\winlogon.exe
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\log.txt
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
%UserProfile%\My Documents\My Pictures\atbyin.exe
c:\Program Files\Common Files\[random path]char.exe
c:\Program Files\Common Files\[random path]calc.exe
c:\Program Files\Internet Antivirus Pro
c:\Program Files\Internet Antivirus Pro\activate.ico
c:\Program Files\Internet Antivirus Pro\Explorer.ico
c:\Program Files\Internet Antivirus Pro\IAPro.exe
c:\Program Files\Internet Antivirus Pro\unins000.dat
c:\Program Files\Internet Antivirus Pro\uninstall.ico
c:\Program Files\Internet Antivirus Pro\working.log
c:\Program Files\Internet Antivirus Pro\db
c:\Program Files\Internet Antivirus Pro\db\DBInfo.ver
c:\Program Files\Internet Antivirus Pro\db\ia080614.db
c:\Program Files\Internet Antivirus Pro\db\lists.ini
c:\Program Files\Internet Antivirus Pro\db\WMILib.dll
c:\Program Files\Internet Antivirus Pro\Languages
c:\Program Files\Internet Antivirus Pro\Languages\IAEs.lng
c:\Program Files\Internet Antivirus Pro\Languages\IAFr.lng
c:\Program Files\Internet Antivirus Pro\Languages\IAGer.lng
c:\Program Files\Internet Antivirus Pro\Languages\IAIt.lng
c:\WINDOWS\system32\[random path].dll
c:\WINDOWS\system32\[random path].dll
c:\Documents and Settings\All Users\Desktop\Internet Antivirus Pro.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro
c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Internet Antivirus Pro Home Page.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Internet Antivirus Pro.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Purchase License.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Internet Antivirus Pro\Uninstall Internet Antivirus Pro.lnk

5

Scan your System:

Scan your System with free scanners for remaining computer parasites

*Name
*E-mail

Enterprise Suite

Created: 2009-11-15 22:06:25 Author:Jackus Zacepinskis

Enterprise Suite is a clone of the popular rogue all-in-one program Windows Enterprise Defender. This parasite is really no different than any other rogue and follows the same mechanism of action. Enterprise Suite enters the system using trojans and drive-by downloads, and feeds the user with misleading information in hopes that he will purchase the "licensed version".Enterprise Suite uses simulated system scans, which appear to be real, but actually mark legitimate processes as worms,...

Posted in: Rogue Anti-Spyware

No comments yet

Windows Enterprise Suite

Created: 2009-10-30 00:38:34 Author:Jackus Zacepinskis

Windows Enterprise Suite is a new rogue anti-spyware in the VirusMelt family of rogues, which has brought us such nasty scams as Windows System Suite. This parasite relies on downloader trojans to enter the system, and uses misleading advertising to trick users into purchasing it's "licensed version". Windows Enterprise Suite spams the user with popups and fake system notifications, claiming his system is infected and in need of a security program. Like most other rogues, this one will try...

Posted in: no categories

No comments yet

Live Security Suite

Created: 2010-05-17 02:48:23 Author:Renata Mykolaityte

Live Security Suite is an application that spreads on computer systems imitating a security tool but in fact it’s a computer infection. It infiltrates with a help of Trojan viruses and once there, displays tons of security alerts, runs its scanner without you asking to do so and causes many more problems. Live Security Suite is started when computer is rebooted. It is done automatically each time you log in to Windows. At first Live Security Suite runs its scanner and reports about...

Posted in: Rogue Anti-Spyware

No comments yet