Description of BlueFlare Antivirus and consequences of its residing on your PC’s

BlueFlare Antivirus is another fake antispyware that pretends to help protecting your PC. The tricky software product, to increase the level of trust to the program, is dressed in blue colors inherent to Windows software and the OS dialogs.
The software product, once  installed, creates executable, which name is the same as that of legitimate and critical system file. It is only different from that file as it is stored in different place, but that is not an excuse for not making accent on that extreme precaution is required to remove BlueFlare Antivirus without detriment to precious and harmless entries. Please double-check the entries to be deleted, if you are going to get rid of the parasite manually, or better  treat your computer system with free scanner to automatically and safely exterminate the rogue. For non-manual deletion of the scamware,  free scanner is available here.

Technical Details and screenshots:

  • Full name: BlueFlare Antivirus, Blue Flare Antivirus, Blue-Flare Antivirus
  • Version: 2012
  • Type: Rogue anti-spyware
  • Origin: Russian Federation, Ukraine

Signs of being infected with BlueFlare Antivirus

BlueFlare Antivirus is a self-start scanner. In most of the cases, the scan in not requested by user, neither user is about to welcome it. Alas, attempts to collapse or close scan window usually resolve to system freezes or program keeps running in spite of the user’s commands.
The scan window reflects, or rather pretends to reflect, locations currently scanned. The malware does not adopt its scanner to particular case so that, since the scan is fake, the locations indicated in the scan progress bar may not exist in your computer memory.
Anyway, the scan is a showcase and should only be taken into account as evidence of the adware presence.
The adware is notorious for another alert, which sounds somewhat like a system notification being generated at the system tray. That alert states the application cannot start because of notepad error. There is no notepad error and the application could have been started, had the malware made no restrictions to its functioning.
The trick is extremely efficient tactic of deluding users as they imagine the adware is a genuine detector of treats, yet of extreme precision as they have been shown the prediction and how it has come true. Apart from that, the alert is a good sign in the sense that few users can manage to ignore it.
Click here to run free computer inspection on order to get rid of BlueFlare Antivirus fraudware detecting the infection by signs visible for security solution and invisible for PC users.

BlueFlare Antivirus automatical removal:

The solution below is a multi-purpose tool enabling users to get rid of BlueFlare Antivirus and other infections. It applies both behavior based (heuristic) and description based (traditional) routines to detect and contain computer infections.

BlueFlare Antivirus Removal Tool

Manual Removal of BlueFlare Antivirus:

A core file of the scamware is known to bear the following system name: csrss.exe.
This file is to be detected in, and deleted from, Startup Folder. It is not to be confused with same-name entry located in Sysytem32 folder of Microsoft directory. Deletion of the latter, legit Microsoft file will cause serious system malfunctioning.
It is important that you find and delete right files, and in right folders, or else actual components of the scamware will survive, but system will be damaged badly.

Remove BlueFlare Antivirus files and dll’s:

%AppData%\BlueFlare Antivirus\
%AppData%\BlueFlare Antivirus\BlueFlare Antivirus.exe
%AppData%\BlueFlare Antivirus\BlueFlare Antivirus.ico
%AppData%\BlueFlare Antivirus\csrss.exe
%AppData%\BlueFlare Antivirus\ms.conf
%StartMenu%\BlueFlare Antivirus
%StartMenu%\BlueFlare Antivirus\BlueFlare Antivirus.lnk
%StartupFolder%\csrss.exe
%UserProfile%\Desktop\BlueFlare Antivirus.lnk

Unregister BlueFlare Antivirus registry values:

%UserProfile% refers to the current user’s profile folder. By default, this is C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7, and c:\winnt\profiles\<Current User> for Windows NT.

%AppData% refers to the current users Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\<Current User>\AppData\Roaming.

%StartupFolder% refers to the Startup folder in the Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\programs\Startup, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\<Current User>\Start Menu\Programs\Startup, and for Windows Vista/7 it is C:\Users\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

%StartMenu% refers to the Windows Start Menu. For Windows 95/98/ME it refers to C:\windows\start menu\, for Windows XP, Vista, NT, 2000 and 2003 it refers to C:\Documents and Settings\<Current User>\Start Menu\, and for Windows Vista/7 it is C:\Users\<Current User>\AppData\Roaming\Microsoft\Windows\Start Menu.

Info from bleepingcomputer.com

BlueFlare Antivirus Remover with free scan