TechJaws.com » Fake Antivirus

Security Tool Installs as a Firefox and Flash Update

Frank Jovine — Wed, 28 Jul 2010 14:37:47 +0000

The pesky Security Tool Virus is back again, but this time, the rogue distributors are using a different tactic to get users to install this malicious and fake antivirus program.

The old trick was false and exaggerated scans that would make a user believe that their system is infected. The playing field has changed as these criminals are now using a fake Firefox “Just Updated” page. This is the page that loads immediately after an Firefox update. The page shows a message that tells the user that they need to update their Adobe Flash Player.

Once a user is on the “Just Updated” page, a download dialog box will pop-up automatically without the user clicking anything on the page. If the user clicks “Save File” the rogue antivirus program will be installed. This rogue program will wreck havoc on a users system and cause the system to be unusable.

How to remove Security Tool Virus

Manually

Stop Security Tool Processes: [random numbers].exe
Remove Security Tool Files
C:\Documents and Settings\All Users\Application Data\[random numbers]\
C:\Documents and Settings\All Users\Application Data\[random numbers]\[random numbers].exe
Remove Security Tool Registry Keys

*HKEY_CURRENT_USER\Software\Security Tool
*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Security Tool

Remove Security Tool Startup Entry: [random numbers].exe

Automatically

You can also download MalwareBytes Anti-Malware to remove Security Tool Virus.
F-Secure has already updated their AV product to block and remove Security Tool Virus. They offer a 30 day free trial of Anti-Virus 2010.

Read more removal instructions and comments here.

Beware of Antispymv.com a Malicious Website

Frank Jovine — Fri, 23 Jul 2010 16:58:40 +0000

Antispymv.com is a browser hijacker that distributes Antivir Solution Pro program and other fake antivirus solutions. This rogue software spreads from a Trojan and is installed automatically without user’s knowledge and consent.

Type: Misleading Application / Browser Hijacker
Publisher: Antispymv.com
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: Antivir Solution Pro is a misleading application that may give exaggerated reports of threats on the computer.

How to remove Antivir Solution Pro:

Download a free copy of Malwarebytes’ Anti-Malware to remove this software.

How to manually remove Antivir Solution Pro registry values:

Note: The manual removal of files and registries should be performed by experienced users.

HKEY_CURRENT_USER\Software\AvSuite
HKEY_LOCAL_MACHINE\Software\AvSuite
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “{random string}”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “{random string}”

Other malicious files:

%Documents and Settings%\[UserName]\Local Settings\Application Data\{random string}\{random string}.exe

See more rogue software removal instructions here.

If you have the WOT add-on installed for Firefox or IE, you will now get a warning for this malicious website.

How to Remove Antivirus GT

Frank Jovine — Thu, 22 Jul 2010 14:51:28 +0000

Antivirus GT is a rogue anti-virus program. Graffiti-Blogger.com is the site that promotes Antivirus GT program. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads Antivirus GT and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Name: Antivirus GT
Website: Graffiti-Blogger.com
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: Antivirus GT is a misleading application that may give exaggerated reports of threats on the computer.

How to Remove Antivirus GT

Download a free copy of Malwarebytes’ Anti-Malware to remove this software.

Antivirus GT Manual Removal:

Note: The manual removal of files and registries should be performed by experienced users.

Antivirus GT registry values:

HKEY_CURRENT_USER\Software\EVA246
HKEY_CLASSES_ROOT\CLSID\{E2BFE352-A303-4EA8-88FE-CE35361D7E8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2BFE352-A303-4EA8-88FE-CE35361D7E8B}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AVGT”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “WinNT-EVI 12.03.2010″

Antivirus GT DLLs:

UpdateExplorer.dll

Other malicious Antivirus GT files:

c:\Documents and Settings\All Users\Start Menu\AVGT
c:\Documents and Settings\All Users\Start Menu\AVG\Antivirus GT.lnk
c:\Documents and Settings\All Users\Start Menu\AVG\Uninstall.lnk
c:\Program Files\AVGT
c:\Program Files\AVGT\Antivirus GT.exe
c:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
c:\WINDOWS\system32\UpdateExplorer.dll
%UserProfile%\Desktop\Antivirus GT.lnk

See more rogue software removal instructions here.

If you have the WOT add-on installed for Firefox or IE, you will now get a warning for this malicious website.

How to Remove MedicCop Rogue AntiSpyware

Frank Jovine — Tue, 20 Jul 2010 17:11:24 +0000

MedicCop is a rogue Anti-Spyware program. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads MedicCop and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Name: MedicCop
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: MedicCop is a misleading application that may give exaggerated reports of threats on the computer.

How to remove MedicCop:

Download and install SUPERAntiSpyware and Malwarebytes Anti-Malware. Both security programs come with free versions.

I recommend that you run multiple passes of SUPERAntiSpyware and Malwarebytes Anti-Malware.

It’s important that you keep your security programs up to date. I highly recommend downloading the WOT (Web of Trust) add-on for IE and/or Firefox. The WOT add-on warns you about risky sites before you click.

How to Remove Antivir Solution Pro

Frank Jovine — Tue, 13 Jul 2010 20:28:04 +0000

Antivir Solution Pro is rogue anti-spyware program. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads Antivir Solution Pro and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Name: Antivir Solution Pro
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: Antivir Solution Pro is a misleading application that may give exaggerated reports of threats on the computer.

How to remove Antivir Solution Pro:

Download a free copy of Malwarebytes’ Anti-Malware to remove this software.

How to manually remove Antivir Solution Pro registry values:

Note: The manual removal of files and registries should be performed by experienced users.

HKEY_CURRENT_USER\Software\AvSuite
HKEY_LOCAL_MACHINE\Software\AvSuite
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” =”1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:5555″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = “.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “{random string}”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “{random string}”

Other malicious files:

%Documents and Settings%\[UserName]\Local Settings\Application Data\{random string}\{random string}.exe

See more rogue software removal instructions here.

Beware of this Fake Antivirus Program AV Security Suite

Frank Jovine — Tue, 06 Jul 2010 17:09:13 +0000

AV Security Suite is a Fake Antivirus application. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads AV Security Suite and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Infection Length: 286,464 bytes
Name: AV Security Suite
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: AVSecuritySuite is a misleading application that may give exaggerated reports of threats on the computer.

Installation

When the program is executed, it creates the following file:
%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe

Next, the program creates the following registry entries so that it executes whenever Windows starts:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[EIGHT RANDOM CHARACTERS]” = “%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”[EIGHT RANDOM CHARACTERS]” = “%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe”

It also modifies the following registry entries to lower Internet Explorer security settings:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\”CheckExeSignatures” = “no”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\”RunInvalidSignatures” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\”EnabledV8″ = “0″
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\”Enabled” = “0″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\”SaveZoneInformation” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\”LowRiskFileTypes” = “.exe”

It also creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\AVSuitE
HKEY_LOCAL_MACHINE\SOFTWARE\avSofT
HKEY_CURRENT_USER\Software\avSofT

How to Remove AV Security Suite
The following instructions pertain to all current and recent Symantec Antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan.
Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

if you do not have Norton Antivirus, you can download a free copy of Malwarebytes’ Anti-Malware to remove this software.

See more fake antivirus removal instructions here.

How to Remove Internet Security 2010 Rogue Software

Frank Jovine — Fri, 04 Jun 2010 16:19:19 +0000

Internet Security 2010 is a rogue (fake) internet security suit that gives false reports of threats on the computer. Once a user downloads this application, they’re prompted to purchase the full license in order to remove the false infection.

Name: Internet Security 2010
Publisher: Internet Security 2010
Website: defendvirus.com
Risk Impact: Medium
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

How to Remove Internet Security 2010

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan.
Delete any values added to the registry.

You can download a free copy of Malwarebytes’ Anti-Malware to remove this software.

See more fake antivirus removal instructions here.

FBI File Charges Against Scareware Authors

Frank Jovine — Mon, 31 May 2010 13:39:16 +0000

Three men who made more than $100 million selling scareware have been charged by the FBI. They sold their fake antivirus programs in over 60 countries. The programs they sold that we published articles about are; ”Malware Alarm“, “Antivirus 2008” and “VirusRemover 2008“.

Scareware has been on the rise since 2008 and it continues to be the bread winner amongst scams. Scareware tricks users into thinking their computers are infected with viruses and or malware, and in order to remove the infection, a user must purchase the products license. In most cases, the victims visit particular websites and they are then urged to purchase scareware products such as; anti-spyware and antivirus products.

Such fraud was essentially outlawed at the end of 2008, when the Federal Trade Commission (FTC) got a US court to prevent two manufacturers of scareware from continuing to sell their products. The three men now facing charges did business from the US and the Ukraine via such companies as “Byte Hosting Internet Services” and “Innovative Marketing”.

Facts: 15 percent of all malware is now scareware and that this percentage is still rising.

Related Articles

Removing Rogue Fake Antivirus
How to Remove and Avoid Rogue Applications
Rogue Software Rising at an Alarming Rate
Misleading Applications Rising at an Alarming Rate

The FBI and FTC may never stop the distribution of scareware all together, but charging these three men is a step in the right direction.

Removing Rogue Fake Antivirus

Frank Jovine — Mon, 17 May 2010 18:03:31 +0000

Rogue Fake Antivirus are distributed through websites that simulate virus scans. When a user downloads a Fake Antivirus program and runs a scan, the program reports false scan alerts. This rogue software tries to fool the user in purchasing the full license in order to remove the false threats. Unfortunately, these Fake Antivirus programs do more harm to your computer and are tough to remove.

There are a couple of ways to rid these Rogue Fake Antivirus Programs, but I am going to share a step by step approach that will remove a majority of these Fake Antivirus programs. If you follow the steps below, you should be able to clean your computer from most infections, including most Malware and Spyware.

Steps to Remove Fake Antivirus Software:

Download the free version of SUPERAntiSpyware to remove Spyware left behind from Rogue Fake Antivirus programs.
Launch SUPERAntiSpyware and run a full system scan.
If you are still experiencing issues, try rebooting your PC in Safe Mode with networking (use F8 right before Windows starts to load).
Launch SUPERAntiSpyware and run a full system scan while your computer is in Safe Mode.
If that doesn’t work, download and install MalwareBytes and run it, doing a full system scan.
Reboot your computer and run a full scan using your Antivirus application (I recommend Microsoft Security Essentials).
Your PC should be disinfected and running smoothly.

I recommend that you run multiple passes of SUPERAntiSpyware and Malwarebytes Anti-Malware.

Check out other free security utility tools.

How to Remove AntivirusDemoFraud – Rogue Antivirus

Frank Jovine — Mon, 29 Mar 2010 17:24:38 +0000

AntivirusDemoFraud is a fake antivirus application. This security risk can be downloaded by other threats on the computer or by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads AntivirusDemoFraud and runs a scan, the program reports false scan alerts. The program than tries to fool the user in purchasing the full license to remove the false errors.

Name: AntivirusDemoFraud
Risk Impact: Medium
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
Behavior: The program reports false or exaggerated system security threats on the computer.

How to Remove AntivirusDemoFraud
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan.
Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

If you do not have Norton Antivirus, you can download a free copy of Malwarebytes’ Anti-Malware to remove this software.

See more fake antivirus removal instructions here.