BehaviorThe program must be manually installed.
The program reports false or exaggerated system security threats on the computer.
The user is then prompted to pay for a full license of the application in order to remove the errors.
InstallationWhen the program is executed, it creates the following files:
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\WistaAntivirus.lnk
- %UserProfile%\Desktop\WistaAntivirus.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\WistaAntivirus\Uninstall wistaantivirus.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\WistaAntivirus\wistaantivirus on the Web.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\WistaAntivirus\WistaAntivirus.lnk
- %ProgramFiles%\WistaAntivirus\alarm.wav
- %ProgramFiles%\WistaAntivirus\click.wav
- %ProgramFiles%\WistaAntivirus\config.cfg
- %ProgramFiles%\WistaAntivirus\dbinfo
- %ProgramFiles%\WistaAntivirus\dll\antirootkit.sys
- %ProgramFiles%\WistaAntivirus\dll\def1.base
- %ProgramFiles%\WistaAntivirus\dll\def2.base
- %ProgramFiles%\WistaAntivirus\dll\def3.base
- %ProgramFiles%\WistaAntivirus\dll\immunization.pl
- %ProgramFiles%\WistaAntivirus\dll\license
- %ProgramFiles%\WistaAntivirus\dll\loader.sys
- %ProgramFiles%\WistaAntivirus\dll\privacy.dat
- %ProgramFiles%\WistaAntivirus\dll\realscanner.dll
- %ProgramFiles%\WistaAntivirus\dll\sig1.base
- %ProgramFiles%\WistaAntivirus\dll\sig2.base
- %ProgramFiles%\WistaAntivirus\dll\sigrules.rul
- %ProgramFiles%\WistaAntivirus\success.wav
- %ProgramFiles%\WistaAntivirus\unins000.dat
- %ProgramFiles%\WistaAntivirus\unins000.exe
- %ProgramFiles%\WistaAntivirus\wistaantivirus.exe
- %ProgramFiles%\WistaAntivirus\wistaantivirus.url
Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"wistaantivirus" = "C:\Program Files\WistaAntivirus\wistaantivirus.exe"
It also creates the following registry subkeys:
- HKEY_CURRENT_USER\Software\wistaantivirus
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wista Antivirus_is1
Similar Security RisksVipAntiSpyware 
