MalwareWar

Behavior
The program must be manually installed.

The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the errors.





Installation
When the program is executed, it creates the following folders:

• C:\Documents and Settings\All Users\Application Data\TEMP\
• %Windìr%\Temp\[RANDOM CHARACTERS].tmp
• %Windìr%\Temp\[RANDOM CHARACTERS].tmp

It then creates the following files:

• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWar 7.3.lnk
• %UserProfile%\Desktop\MalwareWar 7.3.lnk
• %UserProfile%\Local Settings\Temp\MWLanguage.ini
• %UserProfile%\Start Menu\Programs\MalwareWar 7.3\MalwareWar 7.3 Website.lnk
• %UserProfile%\Start Menu\Programs\MalwareWar 7.3\MalwareWar 7.3.lnk
• %UserProfile%\Start Menu\Programs\MalwareWar 7.3\Uninstall MalwareWar 7.3.lnk
• %UserProfile%\Start Menu\MalwareWar 7.3.lnk
• %ProgramFiles%\MalwareWar 7.3\Lang\English.ini
• %ProgramFiles%\MalwareWar 7.3\MalwareWar 7.3.exe
• %ProgramFiles%\MalwareWar 7.3\MalwareWar 7.3.url
• %ProgramFiles%\MalwareWar 7.3\msvcp71.dll
• %ProgramFiles%\MalwareWar 7.3\msvcr71.dll
• %ProgramFiles%\MalwareWar 7.3\mwdb.dat
• %ProgramFiles%\MalwareWar 7.3\uninst.exe

Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"MalwareWar 7.3" = "C:\Program Files\MalwareWar 7.3\MalwareWar 7.3.exe"

It also creates the following registry subkeys:

• HKEY_CLASSES_ROOT\AppID\MalwareWar.EXE
• HKEY_CLASSES_ROOT\AppID\{C291DEE7-D4B6-42d8-A016-302E6141D63B}
• HKEY_CLASSES_ROOT\CLSID\{13901470-5BCF-0EA6-A762-AD195455772B}
• HKEY_CLASSES_ROOT\Interface\{195EA874-7AD8-4BE2-A1D1-ADDFFDC66DCA}
• HKEY_CLASSES_ROOT\Interface\{2568D1BF-6D5E-4B17-81E5-7A97EF5D8F05}
• HKEY_CLASSES_ROOT\Interface\{2F9DB89F-7F95-4C69-B775-A0C6C01DACE1}
• HKEY_CLASSES_ROOT\Interface\{3CDB3874-DC96-4890-A786-4B6089E10980}
• HKEY_CLASSES_ROOT\Interface\{5C03DE51-7AB7-41FC-8D50-ECDF39BA2DC0}
• HKEY_CLASSES_ROOT\Interface\{5EFA24D1-944B-4ED8-99F1-2283F79E4136}
• HKEY_CLASSES_ROOT\Interface\{65605733-BE0B-445A-B221-3C82A6BB1EE0}
• HKEY_CLASSES_ROOT\Interface\{90E3F5BF-324B-433F-96C6-E272F2040D6B}
• HKEY_CLASSES_ROOT\Interface\{B3FC6AF3-D3F4-496F-B8BF-8373BACE33F1}
• HKEY_CLASSES_ROOT\Interface\{B6CB3B36-6134-45B8-83F0-6907B2538890}
• HKEY_CLASSES_ROOT\Interface\{B71726E1-CBFE-425D-8446-15B51F54E493}
• HKEY_CLASSES_ROOT\Interface\{C68F00CE-07D1-48AB-830E-D311D255C894}
• HKEY_CLASSES_ROOT\Interface\{C9605621-B932-4359-AB54-5D88EB56A2A3}
• HKEY_CLASSES_ROOT\Interface\{C9686C59-8568-40B1-9468-15446A529354}
• HKEY_CLASSES_ROOT\Interface\{DAFAF86D-9B59-48C1-895F-4FF84A794675}
• HKEY_CLASSES_ROOT\Interface\{E0394CFD-D54D-4826-932D-8379AB554882}
• HKEY_CLASSES_ROOT\TypeLib\{2108EBD7-160B-4C23-A99F-1F559DDD320A}
• HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWar 7.3
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWar 7.3.exe 7.3
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWar

Similar Security Risks

MalwareWipe

Summary