Beware of this Fake Antivirus Application AntivirusFraud

by Frank Jovine on 02/17/2010 in Fake Antivirus, Security

AntivirusFraud is a fake antivirus application. This security risk can be downloaded by other threats on the computer or by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads AntivirusFraud and runs a scan, the program reports false scan alerts. The program than tries to fool the user in purchasing the full license to remove the false errors.

Name: AntivirusFraud
Risk Impact: Medium
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
Behavior: The program reports false or exaggerated system security threats on the computer.

Installation
When the program is executed, it creates the following files:

• C:\Documents and Settings\All Users\Desktop\Antivirus.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus\Antivirus.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus\Uninstall.lnk
• %ProgramFiles%\Antivirus\Antivirus.exe
• %ProgramFiles%\Antivirus\wscsvc32.exe
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus.lnk
• %ProgramFiles%\Antivirus\AvBho.dll
• %ProgramFiles%\Antivirus\Uninstall.exe

It also creates the following registry subkeys:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus

How to Remove AntivirusFraud
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

If you do not have Norton Antivirus, you can download a free copy of Malwarebytes’ Anti-Malware to remove this software.

See more fake antivirus removal instructions here.