RogueKiller Anti-Malware is a Windows program that can scan your PC for malicious files. Simply download and run the file to start protecting your PC with this program's free tools. RogueKiller Anti-Malware has a simple interface, and all its features can be accessed from the sidebar. Page 1 of 3 - roguekiller log unknown virus malwarebytes defeated - posted in Virus, Trojan, Spyware, and Malware Removal Help: hey im infected with a unkown virus it made my malwarebytes disabled. Malwarebytes Anti-Rootkit It received a lot of reviews and publicity when it was released to public because everyone had very high hopes for products by Malwarebytes. It is unclear what variants of rootkits can be detected by Malwarebytes Anti-Rootkit because it is not mentioned in their official website, but it failed to detect any of the 3. Roguekiller is a popular and useful tool to remove some stubborn malware, but be warned; you better know what you're doing. Malwarebytes is better suited for the home user. While a lot of more popular tools will only scan and delete for you, this tool will show you everything it finds that is a possible problem. Mar 25, 2015 Hi, I have been facing problems of pop-ups/redirects for about 3-4 weeks. I have tried almost all anti malware/adware softwares including malwarebytes, roguekiller, tdsskiller, avast, spyhunter.

Most computer users will have their own experience or know someone who has experienced rogue software being installed onto their system. Although it comes in many forms, rogueware is often referred to as fake antivirus software which is a kind of program that tricks its way onto your computer and pretends to be a real antivirus application. It then runs what is essentially a simulation that tells you your machine is infected with viruses, trojans, worms and other scary programs, and you need to buy their software to remove the problems. This is of course a lie and the issues are fabricated by the fake program to scare you into buying it. There are also similar fakes around that tell you the hard drive is dying and you need to pay a fee to “recover” your files.

Quite often a fake antivirus interferes with current security software and disables Windows functions to try and stop you from disabling its process. It will usually prevent you from running any EXE files such as web browsers, security scanners, Task Manager, Regedit, Command Prompt and just about any other executable. Basically it locks down your PC just enough to make it virtually unusable while also protecting itself from deletion.

The thing about fake antivirus software is it’s mostly non destructive meaning your files aren’t at risk like they would be with a virus or worm which destroys data. Instead they essentially cripple the computer and nag you into paying (which does nothing apart from allow you to stop the fake program) or until you find a way to kill the program and clean up the system. Of course, there are other types of rogue and malicious software around, ransomware being similar but even more aggressive locking you out of Windows completely until you pay a fee.

Thankfully, removing fake antivirus, internet security, antispyware and hard disk recovery programs is quite easy with a little experience, and there are several tools around that can help. Some will be able to kill the process allowing all your software to run normally, using your favorite malware scanner to clean up the leftovers. Other programs can kill and clean at the same time. Here’s some tools for you to try out.

1. RogueKiller

RogueKiller by Tigzy is a highly effective tool at killing most types of rogue software dead in its tracks. This includes just about all fake antivirus or fake hdd rogues, fake police and other types of ransomware, TDSS trojans and several zeroaccess infections. As well as being able to scan and kill malicious running processes, drivers and services using its blacklist, RogueKiller can also perform several repairs to the system some of these programs can leave behind.

After the program has started, it will immediately run a quick scan of running processes and services, and then kill anything found to be malicious. If you wanted to, you could close it after the fake av process has been killed and run a malware scanner such as Malwarebytes to take care of the cleaning process. The program itself does have several options to fix problems such as removing suspicious entries from the Run and RunOnce registry keys, suspicious tasks and also anything malicious in the startup folder. Any shortcuts hidden by fake hdd programs can also be restored.

Simply press Scan and the registry will be checked and you can then selectively remove any entries which don’t appear to be connected with the rogueware before clicking Delete. If during the scan anything in the Hosts file or the Proxy and DNS settings is found to be non standard, you have the option to view what it is and reset any of these back to the default using the three buttons on the right. The MBR option supports up to five physical devices and if an infection is detected in the boot record of a drive, the program has the ability to repair it, reverting back to a standard boot loader.

The RogueKiller.exe has a neat trick because it will sometimes start even though the fake antivirus has blocked executable files from running, for example it bypassed Smart Security but couldn’t do the same on System Care without renaming the exe to Winlogon.exe or Explorer.exe. The program sends anonymous statistics back to the developer and in the RogueKiller window it says that if you don’t agree to this, you shouldn’t use the program.

2. RKill

The Rkill tool was originally designed to quickly kill the process of a fake antivirus or other piece of rogue software so that you could run another tool to clean it up. It’s now become more useful with a few more added abilities that can help you fix and restore some basic system settings that often get affected. These include executable file associations which stop executable files from running and system policies that can disable certain system functions like Task Manager or the Command Prompt.

Although these extra repair functions are very useful, RKill is still not meant to be a removal tool for the fake antivirus or rogueware but a means to stop it from running so you can run other programs to deal with it. The malicious executable file and any startup registry entries will still remain until they are removed by third party software such as Malwarebytes or Hitman Pro etc. You should also not reboot the computer between using RKill and running a malware scan because the rogueware will simply reactivate itself again on startup.

Usage for RKill is simply to download the program and launch it, all other operations for scanning and killing processes, checking the registry, services, digital signatures and the HOSTS file is fully automatic with no interaction required. You will find on the website there are several different links to download, they are in fact the same file but with different names to bypass the rogue process. We found that most newer fake antivirus rogues also block .com and .scr extensions as well as .exe, although renaming the file to winlogon.exe, explorer.exe, userinit.exe or wininit.exe seemed to work pretty much all the time. After RKill has completed, you should now be able to install or run any antivirus/antimalware programs to complete the cleaning process.

3. Using a Product Key to Kill the Fake Antivirus

Although we obviously don’t recommend you do this, but if you were to purchase fake antivirus software, what you should be sent is activation details to register the program. This will consist of something like a user name or email address and a product key which you then enter into the program. After that you will soon discover the software actually does nothing and will just enable you to stop or exit the program. This is useful though, because with the rogue process stopped the system can be scanned normally and the rogue program can easily be removed.

We came across a great website resource called S!Ri.URZ that will give some information and screenshots for most of the fake software out there. What it also lists where possible, is the product key to activate the fake program and any username or email that needs to be entered. Most rogue software will have a “Buy now”, “Activate software” or “Remove all threats” button easily visible so you can enter a serial. Input the details from the S!Ri.URZ website and if activation is successful, the program can now be closed completely allowing real security software to run. As you can see above, we registered System Doctor 2014 using the key provided and the rest was easy after it was closed.

On the next page we have 3 more solutions and some tips if you’re having problems.

12Next › View All

You might also like:

10 Free Tools to Kill Multiple Windows Processes at Once6 Ways to Test if Your Antivirus and Antimalware is WorkingComprehensive List of 26 Uninstallers and Removal Tools for Internet Security and Antivirus Software5 Ways to Kill and View Processes on a Remote ComputerRoguekiller versus malwarebytes archives download7 Ways to Remove a File Extension Association in Windows

Debajit Manna8 years ago

I have tried both both Malwarebytes & Superantispyware but it didn’t resolve the problem but the RogueKiller tool did it all. Thanks for the suggested tools and it is really helpful


The number of times I’ve run into the fake antivirus malware on my and other peoples systems beggers belief… I just wish I could get my hands on the cockroaches that develop this infestation..

mark12 years ago

Thank god something like this came out. I work as a tech at a major university in the technology building. The Rtard teachers constantly get these stupid things. It makes me laugh that the teachers in the COLLEGE OF TECHNOLOGY manage to get these. At least twice a week Ill have to get one of these fake anti viruses off.


I suggest you only use Malwarebytes as it is a fantastic free software that removes much more than the Fake Antivirus software and will not cause any side effects on any operating system,

kaspersky key12 years ago

Wooh this is great software.Thank you Raymond


it really works………
i tried too….
many many thanks to you……

David12 years ago

Great tip, Raymond!


I usually prefer to use Super Anti Spyware. It covers both rogue antiviruses and other kinds of spyware. The free version offers cleanup and the pro version offers realtime protection as well as other features.
Interesting find, nontheless :)

ahmed12 years ago

i used Superantispyware it removes and i’ll try this Fake antivirus thanks Raymond …


Hey Ray,

Thanks for this great post again as it really help my friend’s computer in removing the fake anti-virus.Kudos !!!

webcadre12 years ago

thanks for the info ray! :D


use malwarebytes guys… it really knows how to destroy fake antivirus

Steve12 years ago

It’s also an amazingly fast download too!

I clicked on the link to download, and first thought, “nothing happened”, then checked my download file.

Yep! there it was!

Thank You Raymond!



cool … just with file size 83k only!

amon12 years ago

Nice one to give it a try.
Thanks Raymond for sharing this.


thanks Ray…

kantagara12 years ago

nice tool. thanks.


thanks ray……..

ris12 years ago

really great information Ray


thank you ray ,thats going straight on my usb stick

gaurav12 years ago

Very useful ray.


Good one, Ray…

KAY12 years ago

Wow..nice to know..Thanks for sharing Ray.


thanks Raymond

Victor Hugo12 years ago

Thanks Ray for this important advice.
And also thanks for the guy from Malaysia – Olsen – who developed the software Remove Fake Antivirus.


good info ray. thanks


RogueKiller Versus Malwarebytes Archives Pro

amit raina12 years ago
Roguekiller versus malwarebytes archives vs

thanks good one


RogueKiller Versus Malwarebytes Archives Software

Leave a Reply