This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
This signature detects activities of the misleading application MagicAntiSpy.
MagicAntiSpy is a misleading application described as a spyware removal utility that may give exaggerated reports about potential risks on the computer.
When the program is executed, it creates the following files:
* %UserProfile%\Desktop\Magicantispy.lnk Clean
* %UserProfile%\Start Menu\Programs\Magicantispy\Magicantispy.lnk
* %UserProfile%\Start Menu\Programs\Magicantispy\Uninstall.lnk
It then creates the following registry subkeys:
The program also creates the following registry entry, so that it starts when Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Magicantispy" = "%ProgramFiles%\Magicantispy\Magicantispy.exe"
The program may give exaggerated reports about potential risks on the computer when a scan is run.
- Windows 2000
- Windows 95
- Windows 98
- Windows Me
- Windows NT
- Windows Server 2003
- Windows XP
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.