Popular Reviews

Adware Removal

» Adware Removal

Rogueware Removal

» Rogueware Removal

Keylogger Removal

Fix PC Errors

Helpful Definitions

Learn More

» Learn More

Antispyware Reviews

Registry Cleaner Reviews

Firewall Reviews

Spam Filter Reviews

Virus Doctor


"You guys rock. Your instructions were spot on! Thank You"
- J. Powell

"I was infected by SystemTool today. Thanks for the help on the page. I have removed it completely"
- L. Lepsře

"Your web page on Regclean was extremely helpful and very, very education. Its objectivity to was nothing short of excellent. Thank you..."
- Anthony G. Muya

"I want to express my thanks for the information on removing the browser hijacker. I took the steps you suggested and the follow-on precautions to prevent future infections... Thanks again"
- Carlos

For Information and Removal of Virus Doctor

    - what is Virus Doctor
    - automatic and manual removal instructions
    - personal assistance provided online or by phone to safely remove Virus Doctor.

Virus Doctor: The “Cure” is Worse than the Disease   

More and more of our lives are lived online and within our computers; from communicating and working remotely to storing valuable family photos and financial information, we rely on secure systems to safeguard our digital lives.  Because of this need there is a flourishing market in protection software; and there is an equally thriving black market of rogue antivirus software, like Virus Doctor, that seeks to capitalize on the need for security without offering the protection you need.

Introduction to Virus Doctor

A rogue antivirus program is a form of scareware, or software that is designed to accomplish two goals: first, to convince users that there is security risks in their systems, and then to convince them that the “fully licensed” version of the software is the only way to resolve them.  Neither assertion is true. There are likely no security risks present, save for the rogue itself, nor is the program able to provide malware detection or removal.  Popups and false security scan results are part of an intensive campaign to convince users to purchase software that, ultimately, has no positive effect on security.

Hallmarks of Virus Doctor

Virus Doctor, like all other rogue antivirus programs, depends on false warnings in order to create the illusion that your computer is at risk from serious security threats.  It is important to remember that while these “warnings” can be convincing, they are completely false.  When Virus Doctor installs itself, it reconfigures your security settings in order to launch upon startup and run without interruption.  The silver lining is that rogues like these are relatively easy to spot once you know what to look for.

The most obvious hallmark is the presence of popups and false security scans.  These are typically designed to mimic those of legitimate security programs, but taking a moment to scrutinize any message carefully can alert you to a rogue’s presence.  Virus Doctor issues popup messages like the following:

Malicious applications which can contain Trojans found on your PC need to be immediately removed.  Click here to remove these potentially harmful items immediately with Virus Doctor.

An unauthorized program has been prevented from accessing your PC.#Port:433 from


An unidentified program – potentially: :%ThreatPath% #malicious and able to modify system files – has been prevented from getting installed on your PC.

The developers of these programs use specific details, such as IP address (i.e., “”) in order to convey the message of authenticity, but these “threats” do not exist.

Virus Doctor also uses fake security scans in order to persuade users that they are at risk.  Like the popups, these mimic legitimate applications.  You will notice the “Virus Doctor” name at the top left corner of the window, as well as in the right corner, where it is accompanied by a brick wall logo.  Users are urged to “Register Virus Doctor to get full protection against potentially malicious, virus, spy and unwanted software.”  Below this warning, the rogue indicates that your system has not been scanned yet but that it has found that your firewall, automatic updating, malware protection, and other security settings are turned off.

Example Screen Shot Of Virus Doctor

Virus Doctor


The false scan results have the same appearance, but they provide a list of “threats” that Virus Doctor claims to have detected.  Computer users are urged to register the program in order to clean up the risks.  There is a sense of urgency, and this is what rogue developers count on. They want users to act without thinking.

If these ads are clicked on, they will direct the user to a rogue website, typically VirusDoctor-online.com, where they are urged to purchase the full protection of the software.  Remember, though, that just as there are no threats, there is no protection to be gained from this rogue.

When a rogue antivirus program has downloaded or installed itself in a system, popups and false scans are typically the most noticeable symptoms, but users may also notice that their computers are running more slowly than usual. This is because rogues like Virus Doctor remain running in the background continually, diverting system resources from legitimate programs.  You may also notice that there are unfamiliar icons on your desktop or systems tray.  These will also divert the user to the rogue website.

Virus Doctor Access Points

Rogues depend on two different types of access: stealth and user installation.  Stealth installation is typically done via Trojans, which can enter the computer when a user clicks on an advertisement, banner, or popup while browsing.  Virus Doctor is associated with the Trojans Zlob and Vundo, which disguise themselves as Video ActiveX codecs in order to gain access. While Trojans have traditionally been associated with adult sites, they are also prevalent on sites with gaming, warez, pirated, peer-to-peer, file-sharing, and trending content.  Trojans enter and deposit their passengers, which are malware programs like Virus Doctor, into the user’s system.

It is also possible for a user to purchase and install the program after being bombarded with warnings and threats.  Thinking that it is the only way to resolve risks and protect their computers from future problems, they opt to install Virus Doctor.  This is an understandable reaction, but unfortunately, rogues are not able to detect or remove malware.

Removing Virus Doctor

Remove Virus Doctor as soon as you are aware of symptoms.  These rogues are not subtle, and if you know what to look for, you will be able to determine if one has been downloaded or installed in your system.  Removing these programs, though, is easier said than done.  They are not classified as viruses, so conventional security programs will not be able to detect or remove them.  In fact, Virus Doctor can alter your security settings or disable your legitimate program altogether.  This makes running your antivirus software ineffective.  Nor can you simply uninstall because these programs hide in your system registry.

There are two methods that are effective in removing these rogues from your system: automatic and manual.  Automatic removal via a legitimate program like Malwarebytes Anti-Malware (Malwarebytes has free malware removal) requires only minimal technical experience.  This program, unlike traditional security programs, is designed specifically to handle rogue antivirus programs and will remove all trace in order to return your computer to normal function. 

Manual removal is more difficult because you risk inadvertently deleting necessary files and processes and/or failing to remove each and every file and registry key associated with the rogue. In this case, Virus Doctor can reconfigure itself and launch again.  Manual removal can be effective, but it requires extensive technical experience, time, and patience.  If you want to try, use the following directions to manually remove Virus Doctor and feel free to contact us for help.

Block Rogue Sites:


Remove Processes:


Delete Registry Entries:

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run virus doctor
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run virus doctor
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 displayicon
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 displayversion
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 helplink
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 inno setup: app path
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 inno setup: icon group
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 inno setup: setup version
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 inno setup: user
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 installdate
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 installlocation
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 nomodify
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 norepair
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 publisher
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 urlinfoabout
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\virus doctor_is1 urlupdateinfo
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run virus doctor

Unregistered DLLs:


Delete Files:

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus Doctor.lnk
%UserProfile%\Application Data\Virus Doctor\settings.ini
%UserProfile%\Application Data\Virus Doctor\uill.ini
%UserProfile%\Desktop\Virus Doctor.lnk
%UserProfile%\Start Menu\Programs\Virus Doctor.lnk
%UserProfile%\Start Menu\Virus Doctor.lnk
C:\Documents and Settings\All Users\Application Data\[RANDOM]\Languages\VDDe.lng
C:\Documents and Settings\All Users\Application Data\[RANDOM]\Languages\VDFr.lng
C:\Documents and Settings\All Users\Application Data\[RANDOM]\Languages\VDIt.lng
C:\Documents and Settings\All Users\Application Data\[RANDOM]\System Data Configuration\DBInfo.ver
C:\Documents and Settings\All Users\Application Data\[RANDOM]\System Data Configuration\vd[RANDOM].bd
C:\Documents and Settings\All Users\Application Data\[RANDOM]\unins000.dat
C:\Documents and Settings\All Users\Application Data\System Data Configuration\config.cfg
C:\Documents and Settings\All Users\Application Data\System Data Configuration\DB.ini

Removing Virus Doctor Automatically/Safely

For free automatic removal we recommend using Malwarebytes Anti-Malware. This program is widely recommended by reputable third-party sites, so you can be reasonably confident of its ability to safely get rid of Virus Doctor and any hidden Trojans. As a precaution we recommend double checking your system with SpyHunter. This program requires paid registration to enable deletions, however it has a money back guaranteed and is the top of the line in malware removal. It should catch malware that evades Malwarebytes and block anything that tries to reinstal itself.

Download SpyHunter

Remove Virus Doctor Now:

  1. Download and install Malwarebytes Anti-Malware and SpyHunter Download  
  2. Run a scan with Malwarebytes Anti-Malware.
  3. Remove all the detected infections (free).
  4. Run a scan with SpyHunter
  5. Remove any remaining infections
  6. Reboot and rescan with SpyHunter. Your computer should now be clean.

Important note: If Malwarebytes is blocked by malware then run Chameleon (Start Menu → All Programs → MalwareBytes' Anti-Malware → Tools → Malwarebytes' Anti-Malware Chameleon). If you need further help removing Virus Doctor please email us at info@removeadware.com.au or call for personal assistance on toll-free number 888-655-3453, within the USA and Canada.

Disclaimer: This webpage was created to provide information on Virus Doctor and how to uninstall it. Manual removal instructions are intended for use by technical experts and should be used at your own risk. We do not own or endorse Virus Doctor.

We are affiliated with some of the legitimate programs recommended on this website. Should you choose to use the programs recommended here, we may receive a fee that will help support the site.

All content copyright 2006-2017, RemoveAdware.com.au. Author: Wayne Davis.
All Rights Reserved. All trademarks and company brand names are acknowledged.
Privacy Policy | Terms Of Service