Antivirus is a new rogue antispyware program, which is an update to previously published Defense Center. Both programs from the same family of malware as Digital Protection, Your Protection, User Protection, Dr. Guard, etc. Like other similar programs Antivirus malware uses trojans to spread itself. To penetrate a computer, these trojans exploit vulnerabilities in the programs already installed on your computer. This is basically Internet Explorer, Adobe Acrobat Reader (this is needed to view pdf files) and Adobe Flash Player (browser add-on that needed to watch online video). When a trojan is activated, it first does not manifest itsel, but after awhile, it starts to show various fake security alerts and warnings that your computer is in danger and urgently needed to install and activate antivirus, this “antivirus” – Antivirus malware. Even if you ignore these warnings, what is right, this trojan secretly start the download core components of this fake antivirus program and then install it without your permission and knowledge.
In first start, this malicious program scans your computer for an already installed antivirus and antispyware utilities (AVG, Avira, Malwarebytes’ Anti-Malware, McAfree, F-secure, Nod32, etc), and if they are found, required to remove them under the pretext that they may conflict with it by showing the following alert:
Antivirus
Uncertified {antivirus name} antivirus software detected on your computer. You need to remove
{antivirus name} software for correct operation of the Protection Center.
Attention: If you don`t remove {antivirus name} software, the performance of your computer will
dramatically degrade.
Press “OK” to remove the {antivirus name}
Further, Antivirus creates an entry in «HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run» key of Windows registry, that allowing itself to run automatically every time you start Windows. When this malware is started, it begins to scan the computer and detects a large number of trojans, viruses, worms, etc. These results, as well as self scanning, is nothing but a scam. In reality the fake security program cannot detect and remove malicious programs, as well as not be able to protect you from possible infections in the future. Thus, you can safely ignore all that this fake antivirus will show you.
For a more complete picture of what your computer is infected with dangerous viruses, this malware will display fake Windows Security Center, numerous fake security alerts and pop-ups, that stats that the computer is infected and offering to buy or activate the full version of this fake antispyware program. Some of the alerts:
Danger!
A security threat detected on your computer.
TrojanASPX.JS.Win32. It strongly recommended to remove
this threat right now. Click on the message to remove it.
Warning! Adware detected!
Adware module detected on your PC!
Warning! Keylogger detected!
Keylogger activity detected on your PC!
Warning! Network attack detected!
Network intrusion detected!
Your computer is being attacked from a remote PC.
Danger!
Unauthorized person tries to steal your passwords and private
information. Click on the message to prevent identity theft.
Warning! Virus threat detected!
Virus activity detected!
Trojan-PSW.Win32.adware has been detected. This adware module
advertised websites with explicit content. Be advised of such
content being possibly illegal. Please click the button below
to locate and remove this threat now.
However, like false scan results above, all of these alerts and warnings are just a fake. This is a method of scare tactics to make you think your computer is infected with all sorts of malicious software. Like false scan results you can safely ignore them.
What is more, Antivirus can block the Windows Task Manager and the work of most legitimate Windows applications, so that they will not even start. If you try to run a program (that have “exe” extension), your computer will display a fake security warning that stats “Warning! Adware detected” or “Warning! Virus threat detected!”. Click Ignore button to close the fake box.
In addition, the trojan which installs Antivirus, will also download and install a variant of TDSS trojan. This trojan is very dangerous because it can block the work of most antivirus and antispyware applications, so that they will not even start. But it’s not all, TDSS trojan can also redirect you from sites that you want to visit on a completely other.
As you can see Antivirus malware is very dangerous and can lead to a complete paralysis of your computer, as well as leakage of your personal data in the hands of the authors of the malicious program. Need as quickly as possible to check your computer and remove all found components of this malware. Use the removal guide below to remove Antivirus from your computer for free.
More screen shoots of Antivirus (AnVi) virus/malware
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [Antivirus] “C:\Program Files\AnVi\avt.exe”
How to remove Antivirus (AnVi) virus/malware
Use the instructions to remove Antivirus (AnVi) from your computer for free.