Multi-Rogue virus family. How to remove it manually

Multi-Rogue virus is the fake anti-spyware program which upon successful penetration inherits its name depending on the installed operating system. So, if users have Windows XP, the virus name would contain “XP” in the beginning. The same principle is applied when nominating the virus brought and installed to other operating systems like Windows Vista or Windows 7. Understanding the need to help you remove this virus effectively and without the necessity to install any programs we have developed the manual removal guide for its deletion. Hence, please be so kind to follow the removal steps described in the section below. You must carefully follow them without exceptions. The video tutorial is provided for you to understand how exactly to remove the virus manually (deleting its files and registry entries).

In order to delete Multi-Rogue virus manually you first must reboot your PC in safe mode or into safe mode with networking. You may find more information about how to do it by clicking this link.

Multi-Rogue virus files to be removed for Windows 7 and Windows Vista operating systems:

• %AllUsersProfile%\[random]
• %LocalAppData%\[random].exe
• %Temp%\[random]
• %LocalAppData%\[random]
• %AppData%\TEMPLATES\[random]

Multi-Rogue virus files to be removed for Windows XP Files:

• %AllUsersProfile%\Application Data\[random]
• %LocalAppData%\[random].exe
• %LocalAppData%\[random]
• %Temp%\[random]
• %UserProfile%\Templates\[random]

File Location remarks:

• %UserProfile% stands for the current user's profile folder. By default, this is C:\Documents and Settings\ for Windows 2000/XP, C:\Users\ for Windows Vista/7, and c:\winnt\profiles\ for Windows NT.
• %Temp% stands for the Windows Temp folder. By default, this is C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\\AppData\Local\Temp for Windows Vista and Windows 7.
• %AllUsersProfile% stands for the All Users Profile folder. By default, this is C:\Documents and Settings\All Users for Windows 2000/XP and C:\ProgramData\ for Windows Vista/7.
• %AppData% stands for the current users Application Data folder. By default, this is C:\Documents and Settings\\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\\AppData\Roaming.
• %LocalAppData% stands for the current users Local settings Application Data folder. By default, this is C:\Documents and Settings\\Local Settings\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\\AppData\Local.

The location of registry entries to be removed:

• HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation "TLDUpdates" = '1'
• HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = '"%LocalAppData%\[random].exe" -a "%1" %*'
• HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command "(Default)" = '"%LocalAppData%\[random].exe" -a "%1" %*'
• HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = '"%LocalAppData%\[random].exe" -a "%1" %*'
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = '"%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"'
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = '"%LocalAppData%\[random].exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode'
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = '"%LocalAppData%\[random].exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"'
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = '1'
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = '1'

Automatic removal video:

Manual removal video: