How to Remove OpenCloud Antivirus (Uninstall Guide)

OpenCloud Antivirus is a rogue anti-virus program that will tell you that your computer is infected with spyware, Trojans or other viruses which is a lie and that you should immediately purchase the program to remove viruses that do not even exist. Unfortunately, it's so generic looking and doesn't have a lot of bells that could make users think it was odd, that's why it's rather easy to fall victim to this scam. The rogue program generates totally misleading pop-ups that look like legitimate warnings from antivirus or antispyware software. Victims usually begin to panic and that's actually the wrong reaction to have. You need to stay calm; otherwise it's going to get even worse. Cyber criminals are using sophisticated tactics to trick unsuspecting computer users into downloading or purchasing potentially dangerous and rogue software. Although, OpenCloud Antivirus is a typical scareware, it can't delete your files or steal your credit card information, unless you've purchased it, however, you still need to remove OpenCloud Antivirus from your computer as soon as possible. If your computer became hijacked by this scareware, please follow the removal instructions below.



OpenCloud Antivirus is quite a bit more aggressive than the previous versions from the same scareware family: Wolfram Antivirus, BlueFlare Antivirus and Milestone Antivirus. It performs fake system scan and detects exactly the same infections on entirely different computers. It's a false claim meant to extort money out of you. What is more, Open Cloud Antivirus sets up a proxy server for your LAN connection and either blocks certain websites or redirects to malicious or infected websites. It also blocks legitimate applications claiming that they are infected or hijacked by malicious software, usually spyware or a Trojan horse.

Security warning:
The file C:\WINDOWS\regedit.exe is infected.
Running of application is impossible.

There is also this fake Windows security alerts stating that a Zeus Trojan is requests an unauthorized access to your computer.

Windows Security Alert
To help protect your computer, Windows Firewall has blocked some features of this program.
Do you want to keep blocking this program?
Zeus Trojan

And there's another one claiming that the svchost.exe process was replaced with malicious one. OpenCloud Antivirus creates an autorun registry entry to run a file called csrss.exe every time Windows starts. Please do not confuse it with the legitimate one which resides in C:\Windows\System32\csrss.exe. The Trojan file then loads the main OpenCloud Antivirus executable OpenCloud Antivirus.exe.

If you can't use your web browser or and run your favorite malware scanner, you can activate the rogue program by entering this registration code: DB038748-B4659586-4A1071AF-32E768CD-36005B1B-F4520642-3000BF2A-04FC910B. Once this is done, you are free to install anti-malware software and remove the rogue anti-virus program from your computer properly. To remove OpenCloud Antivirus and associated malware from your computer, please follow the removal instructions below. Good luck and be safe online!

---

OpenCloud Antivirus removal instructions:

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Launch Internet Explorer. In Internet Explorer go to: Tools→Internet Options→Connections tab. Click Lan Settings button and uncheck the checkbox labeled Use a proxy server for your LAN. Click OK. You may have to repeat steps 1-2 if you will have problems downloading malware removal programs.



3. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

---

Alternate OpenCloud Antivirus removal instructions:

1. Go to Start → Run or press WinKey+R. Type in "command" and press Enter key.


2. In the command prompt window type "notepad". Notepad will come up.

3. Copy all the text in blue color below and paste into Notepad.

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

4. Save file as regfix.reg to your Desktop. NOTE: (Save as type: All files)

regfix.reg is available for download here, in case you can't make your own or it doesn't work. 

5. Double-click on regfix.reg file to run it. Click "Yes" for Registry Editor prompt window. Then click OK.
6. Download free anti-malware software from the list below and run a full system scan.

• MalwareBytes Anti-malware
• SUPERAntispyware
• Spybot S&D
• Hitman Pro 3.5

NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

---

Associated OpenCloud Antivirus files and registry values:

Files:

Windows XP:

• C:\Documents and Settings\[UserName]\Application Data\OpenCloud Antivirus\OpenCloud Antivirus.exe
• C:\Documents and Settings\[UserName]\Application Data\OpenCloud Antivirus\csrss.exe
• C:\Documents and Settings\[UserName]\Application Data\OpenCloud Antivirus\wf.conf
• C:\Documents and Settings\[UserName]\Application Data\OpenCloud Antivirus\sysl32.dll

Windows Vista/7:

• C:\Users\[UserName]\AppData\Roaming\OpenCloud Antivirus\OpenCloud Antivirus.exe
• C:\Users\[UserName]\AppData\Roaming\OpenCloud Antivirus\csrss.exe
• C:\Users\[UserName]\AppData\Roaming\OpenCloud Antivirus\wf.conf
• C:\Users\[UserName]\AppData\Roaming\OpenCloud Antivirus\sysl32.dll

Registry values:

• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "load"="%Temp%\csrss.exe"

Share this information with other people: