Fake Antivirus and spyware softwares

tuandm — Sat, 10 Jan 2009 19:21:53 +0800

Recently, there are alot of fake and dangerous antispyware and antivirus softwares which are appearing everywhere when you surf net. They create a fake system scanning and notice us that our PC affected by viruses. In this tutorial, I will list down the top 10 most dangerous, fake antispywares and antivirus wares.

THE TOP 10:

WinAntispyware2008
Winantivirus2008
PC Protection Center 2008
Power Antivirus 2009
Spyware Guard 2008
AntivirusPro 2009
Virtual Guard Plus
System Optimizer 2008
Personal Anti Spy
AntispywareXP2009

1/ WinAntispyware2008

FAKE NOTICE:
* "Critical System Error",
* "Your computer is infected",
* Hijacked homepage to obscure webpage.
* Flashing icons appear on your system tray (Near of your system clock).

HOW TO REMOVE:
Cách remove

Search and kill the following processes

QUOTE

:
WinAntispyware2008.exe
insthelp.exe
updater.exe
stera.exe
uwasffnt.exe
was6.exe
winantispyware2008freesetup.exe
wasffnt.exe
winantispyware2008setup.exe

Remove WinAntispyware2008 files & dlls files

QUOTE

:
ecofubyg.exe
gilixowa.reg
ewapili.com
uwudoj.reg
WinAntispyware2008.lnk
adylewu.dl
ezeh.pif
usow.db
ysuzis.bat
WinAntispyware2008
amufy.db
egogoko.sys
htmlayout.dll
pthreadVC2.dll
WinAntispyware2008.cfg
WinAntispyware2008.dll
WinAntispyware2008.exe
datadaily.cvd
msvcm80.dll
msvcp80.dll
msvcr80.dll
byfupo.dl
jezuro.ban
okulyretaq.dl
ymanev._sy
yqumo.db
fuduco.com
juporel.vbs
retyn.lib
roforawav.bin
upoceso.ban

Remove/Modify corrupt Registry Entries

QUOTE

:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0723CAE 4-C2AB-4995-B749-6BC9BE984564}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{461 9EC5B-EF8F-44E9-9A74-6E7B5F1C4188}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EFB D98B0-0C01-4325-85F8-5E791AB33570}

[addedon]January 10, 2009, 7:25 pm[/addedon]2/ Winantivirus2008

Image:

Affacted anoucement:

* "Critical System Error",
* "Your computer is infected",
* "Trojan-Spy.win32@mx",

How to remove:

Search and kill the following processes

QUOTE

WINANTIVIRUS2008[1].EXE,
winantivirus2008.EXE
mav_startupmon.exe
uwa7pcw.exe
rtasks.exe
WinAv.exe
wa7pinst.exe

Remove Winantivirus2008.org files & dlls files

QUOTE

%UserProfile%\Desktop\Viruses.bdt
%UserProfile%\Desktop\WinAntivirus2008.lnk
c:\Program Files\WinAntivirus2008
c:\Program Files\WinAntivirus2008\Viruses.bdt
c:\Program Files\WinAntivirus2008\VRM2008.exe
c:\Documents and Settings\All Users\Start Menu\Programs\WinAntivirus2008
c:\Documents and Settings\All Users\Start Menu\Programs\WinAntivirus2008\WinAntivirus2008.ln k
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\WinAntivirus2008.lnk
rtasks
rtasks.exe
wa7pinst.exe
IH.exe

WINANTIVIRUS2008[1].EXE,
winantivirus2008.EXE
mav_startupmon.exe
uwa7pcw.exe
rtasks.exe
WinAv.exe
wa7pinst.exe

WinAntiVirus Pro.lnk
Reinstall or Uninstall WinAntiVirus Pro.lnk
WinAntiVirus Pro Manual.lnk

Remove/Modify corrupt Registry Entries

QUOTE

HKEY_CURRENT_USER\Software\WinAntivirus2008

5222008A-DD62-49c7-A735-7BD18ECC7350
2178F3FB-2560-458f-BDEE-631E2FE0DFE4
6F520BE0-9B54-4558-816F-224E67997DF3
459F4226-1AAB-43B6-9DC1-B6313EF83749
1AC5C88A-DEA7-462b-A232-04AF5CA42E7E
723D54C7-7483-4EB8-8EED-CE5B2AEA534D

[addedon]January 10, 2009, 7:28 pm[/addedon]3/ PC Protection Center 2008

Image

How to remove:

Step 1: Kill the PC Protection Center 2008 Processes

QUOTE

:
c:\Program Files\PC Protection Center 2008\PcProtection.exe
c:\Program Files\PC Protection Center 2008\uninstall.exe
c:\Program Files\PC Protection Center 2008\PcProtection.exe.MANIFEST
xpa.exe

Step 2: Remove PC Protection Center 2008 files, folders and all associated PC Protection Center 2008 DLL files

QUOTE

:
c:\WINDOWS\system32\vbzlib2.dll

c:\Program Files\PC Protection Center 2008\options.ini
c:\Program Files\PC Protection Center 2008\uninstall.log
c:\Program Files\PC Protection Center 2008\vbase.ini
c:\Program Files\PC Protection Center 2008\lang
c:\Documents and Settings\All Users\Start Menu\Programs\PC Protection Center 2008\PC Protection Center 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\PC Protection Center 2008\Remove PC Protection Center 2008.lnk
c:\Program Files\PC Protection Center 2008\lang\english.lng
c:\Program Files\PC Protection Center 2008\lang\russian.lng
c:\Documents and Settings\All Users\Desktop\PC Protection Center 2008.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\PC Protection Center 2008

c:\Program Files\PC Protection Center 2008\

%common_programs%registrydoctor2008
%program_files%registrydoctor2008

Step 3: Uninstall PC Protection Center 2008 registry entries

QUOTE

:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\PC Protection Center 2008
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run “PC Protection Center”

Lowyat.NET: Latest topics by tuandm

Fake Antivirus and spyware softwares