BehaviorThis program must be manually installed on the computer.
When the application is executed, the main window displays the following message:
Found Virus!! Please register to remove it.
Anti-Virus and Spyware started!
The program falsely reports some legitimate programs as threats on the computer. For example, the program lists Adobe Acrobat Reader as a BHO.
The program prompts the user to purchase a full version of the software in order to remove the falsely detected threats from the computer.
InstallationWhen the program is installed, it creates the following files:
- %ProgramFiles%\Anti-Virus&Spyware\Anti-Virus.exe
- %ProgramFiles%\Anti-Virus&Spyware\Anti_Virus Help.chm
- %ProgramFiles%\Anti-Virus&Spyware\EGhostLog.txt
- %ProgramFiles%\Anti-Virus&Spyware\hook.dll
- %ProgramFiles%\Anti-Virus&Spyware\Products.htm
- %ProgramFiles%\Anti-Virus&Spyware\SkinPlusPlusDLL.dll
- %ProgramFiles%\Anti-Virus&Spyware\unins000.dat
- %ProgramFiles%\Anti-Virus&Spyware\unins000.exe
- %ProgramFiles%\Anti-Virus&Spyware\virus.update
- %ProgramFiles%\Anti-Virus&Spyware\Visit Our Site.url
- %ProgramFiles%\Anti-Virus&Spyware\XPCorona.ssk
- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Anti-Virus&Spyware.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Anti-Virus&Spyware.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Help.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Our Products.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Uninstall.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware\Visit Our Site.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus&Spyware.lnk
It also creates the following registry subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ete\Extension\{223bd3fe-342e-ffae-3c9f-fe62375679e1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Virus&Spyware_is1
Similar Security RisksThe following is a list of names of security risks that may function in a similar manner to this misleading application:
- TrojanGuarder
- AntiVirusAndTrojan
