Antispyware Soft Removal and Analysis

Antispyware Soft is similar in interface and behavior to Antivirus Soft, Antivirus Live and Antivirus soft scareware. This malicious, rogue security software aggressively displays fraudulent system security alerts about non-existent network infiltration attempts and malware.

The anti spyware soft rogue when installed:

• Installs the Fake Windows Security Center where all the links lead to its payment page.
• Hijacks Internet Explorer and automatically opens a specific set of porn websites every few minutes.
• Blocks execution of most programs.
• Blocks execution of Task Manager, Command Prompt and MS Configuration editor.
• Blocks Windows firewall, Automatic Updates and Internet Options.
• Disables Internet Explorer Phishing Filter.

Scareware like Antispyware Soft are commonly installed when users are redirected to fake online scanner pages or fake ‘video codec required’ pages distributed through out the Web by cyber criminals using blackhat SEO techniques, Spam and Malicious flash advertisements.

Antispyware Soft Removal (How to remove Antispyware Soft)

MalwareBytes's Anti-Malware Free edition (mbam-setup.exe) was able to remove this infection.

1. Boot in to Window Safe Mode with networking
2. Download Malware Bytes's Anti-Malware Free edition (mbam-setup.exe) or from a clean computer download and copy to a removable drive like CD, DVD or USB flash drive.
3. Double-click mbam-setup.exe to start the installation. Proceed with installation following the prompts. Make sure that the following option is checked when you finish the installation: Update Malwarebytes’ Anti-Malware.
4. Once the update is completed, Launch Malwarebytes’ Anti-Malware and select Perform full scan in the Scanner tab. When the scan is completed, click “Show results“, confirm that all instances of the rogue security software are check-marked and then click “Remove Selected” to delete them. If prompted restart immediately to complete the removal process.
5. Trun System Restore off and on.
   

If you find the Internet Explorer is still being re-directed to the scareware website, remove the proxy settings as follows:

Open Internet Explorer, Click Tools menu and then click Internet options or open Internet options via control panel. In the Internet Options window, select the Connections tab. In the Connections tab, click on LAN settings.

In the Local Area Network (LAN) Settings window, click Advanced and clear the proxy address 127.0.0.1 and port 5555. Click Yes and OK your way out.

You should now be clean of this rogue.

The full version of Malwarebytes’ Anti-Malware performs brilliantly against scareware such as Antispyware Soft. The real-time component of the paid version includes dynamic blocking of malicious websites, servers and prevents execution of malware. It would caution you before most rogue security software could install itself. Please consider purchasing the Malwarebytes' Anti-Malware Full version for additional protection.

Antispyware Soft Analysis

A rogue security software such as Antispyware Soft belongs to a family of software products that call themselves as antivirus, antispyware or registry cleaners and often use deceptive or high pressure sales tactics and deliberate false positives to convince users into buying a license/subscription. They are often repackaged and renamed. They do not actually remove malware instead many of them add more malware of their own. They need to be removed immediately from your system.

The trojan downloader was about 271104 bytes in size. It was detected by 32/41 (78.05%) of antivirus engines available at VirusTotal.

• Trojan.Win32.FakeSpypro
• Trojan/Win32.FraudPack
• W32/FakeAlert.GQ.gen!Eldorado
• Win32:Rootkit-gen
• Win32/XPInternetSecurity.D
• Trojan.Win32.FraudPack.avgj
• Win32/Adware.SpywareProtect2009
• Troj/FakeAV-BGE
• FraudTool.Win32.AVSoft (v)
• SpywareGuard2008
• TROJ_FAKEAV.SMMZ

Typical Antispyware Soft Scare Messages

Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan you computer. Your system might be at risk now.

Infiltration alert. Virus Attack. Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan-dropper or similar.

Users should not fall for the false alerts of system infection and buy the scareware to ‘clean’ the system. If you purchased one by entering your credit card number at a rogue software website, it would be prudent to:

• Immediately contact the bank that issued the card and dispute the charges.
• Request them to not allow any further transaction and cancel the card. You may also request them to issue a new card with a different number.

Antispyware Soft Associated Files and Folders

• C:\Documents and Settings\malwarehelp.org\Local Settings\Application Data\ylyqcrynp\klbqtgitssd.exe
• C:\WINDOWS\Prefetch\KLBQTGITSSD.EXE-02AED8DA.pf

Some of the file names may be randomly generated. The term malwarehelp.org or malwarehelp in the above entries denotes the name of the Windows user account in the test machine.

Antispyware Soft Associated Registry Values and Keys

• HKEY_CURRENT_USER\Software\avsoft
• HKEY_CURRENT_USER\Software\avsuite
• HKEY_CURRENT_USER\Software\avsuite\knkd=1
• HKEY_CURRENT_USER\Software\avsuite\aazalirt=1
• HKEY_CURRENT_USER\Software\avsuite\skaaanret=1
• HKEY_CURRENT_USER\Software\avsuite\jungertab=1
• HKEY_CURRENT_USER\Software\avsuite\zibaglertz=1
• HKEY_CURRENT_USER\Software\avsuite\iddqdops=1
• HKEY_CURRENT_USER\Software\avsuite\ronitfst=1
• HKEY_CURRENT_USER\Software\avsuite\tobmygers=1
• HKEY_CURRENT_USER\Software\avsuite\jikglond=1
• HKEY_CURRENT_USER\Software\avsuite\tobykke=1
• HKEY_CURRENT_USER\Software\avsuite\klopnidret=1
• HKEY_CURRENT_USER\Software\avsuite\jiklagka=1
• HKEY_CURRENT_USER\Software\avsuite\salrtybek=1
• HKEY_CURRENT_USER\Software\avsuite\seeukluba=1
• HKEY_CURRENT_USER\Software\avsuite\jrjakdsd=1
• HKEY_CURRENT_USER\Software\avsuite\krkdkdkee=1
• HKEY_CURRENT_USER\Software\avsuite\dkewiizkjdks=1
• HKEY_CURRENT_USER\Software\avsuite\dkekkrkska=1
• HKEY_CURRENT_USER\Software\avsuite\rkaskssd=1
• HKEY_CURRENT_USER\Software\avsuite\kuruhccdsdd=1
• HKEY_CURRENT_USER\Software\avsuite\krujmmwlrra=1
• HKEY_CURRENT_USER\Software\avsuite\kkwknrbsggeg=1
• HKEY_CURRENT_USER\Software\avsuite\ktknamwerr=1
• HKEY_CURRENT_USER\Software\avsuite\iqmcnoeqz=1
• HKEY_CURRENT_USER\Software\avsuite\ienotas=1
• HKEY_CURRENT_USER\Software\avsuite\krkmahejdk=1
• HKEY_CURRENT_USER\Software\avsuite\otpeppggq=1
• HKEY_CURRENT_USER\Software\avsuite\krtawefg=1
• HKEY_CURRENT_USER\Software\avsuite\oranerkka=1
• HKEY_CURRENT_USER\Software\avsuite\kitiiwhaas=1
• HKEY_CURRENT_USER\Software\avsuite\otowjdseww=1
• HKEY_CURRENT_USER\Software\avsuite\otnnbektre=1
• HKEY_CURRENT_USER\Software\avsuite\oropbbsee=1
• HKEY_CURRENT_USER\Software\avsuite\irprokwks=1
• HKEY_CURRENT_USER\Software\avsuite\ooorjaas=1
• HKEY_CURRENT_USER\Software\avsuite\id=8.0
• HKEY_CURRENT_USER\Software\avsuite\ready=1

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures=no
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures=1
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8=0
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\Enabled=0
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer=http=127.0.0.1:5555
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes=.exe
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\SaveZoneInformation=1
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\njjhiffj=C:\Documents and Settings\malwarehelp.org\Local Settings\Application Data\ylyqcrynp\klbqtgitssd.exe

• HKEY_CURRENT_USER\Software\Microsoft\Windows Script
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
• HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings\JITDebug=1

The term malwarehelp.org or malwarehelp in the above entries denotes the name of the Windows user account in the test machine.

Antispyware Soft Associated Domains

This scareware was observed accessing the following domains during installation and operation:

• avtiviruspower .com

Note: Visiting the domains mentioned above may harm your computer system.

If you are unable to get rid of this scareware, please visit one of the recommended forums for malware help post about your problem.

Antispyware Soft Scareware — Screenshots

Note:- The Antispyware Soft installation and removal was tested on a default installation of Windows XP SP3. The content provided in this article is not warranted or guaranteed by Malware Help. Org. The content provided is intended for entertainment and/or educational purposes. I am not liable for any negative consequences that may result from implementing any information covered in this article. The above information is correct at the time of my testing, it might change with time and or under different testing conditions.

Source :-www.malwarehelp.org

How to Remove the Win32 Autorun Worm?

Computer systems running Windows without proper virus protection and malicious program activity detection are prone to getting affected with malware from the Internet, mobile hard disks and USB memory sticks.

Such a malicious worm called Win32 has been known to secretly and maliciously integrate itself into program or data files on any target computer system running the Microsoft Windows Operating System without proper security measures in place.

The Win32 virus has been observed to spread by integrating itself into more files each time the host program is run. Also known as Win32 Autorun Worm, it can resemble as a legitimate Windows System32 file and exploit your Windows OS to download bad files from other websites.

The Win32 Autorun Worm has also been known to infect any target computer system through undesirable email attachments, media codecs, pornographic material and various kinds of image downloads. The Win32 Autorun Worm has proved to be a serious security threat in many cases where it has been reported to steal secret assemblage and should be removed as soon as it is detected on any computer system.

Win32 Autorun Worm Aliases:

As with any notoriously dangerous computer virus or piece of malware, the Win32 Autorun Worm goes by various aliases that may reside on your computer including but not limited to:

1. Worm.Win32.Autorun.nox
2. Worm.Win32.Autorun.dlw
3. Worm.Win32.Autorun.m
4. Worm.Win32.Autorun.bli
5. Worm.Win32.Autorun.cpe
6. Worm.Win32.Autorun.Isw
7. Worm.Win32.Autorun.nuu
8. Worm.Win32.Autorun.cea
9. Worm.Win32.Autorun.aye
10. Worm.Win32.Autorun.bnb
11. Worm.Win32.Autorun.cgi
12. Worm.Win32.Autorun.hr

Usual Win32 Autorun Worm Symptoms to look for:

1. Your computer system causes unfamiliar Windows sound errors.
2. Your computer system experiences corrupt or nonexistent registry entries causing crashes and showing the blue screen of death.
3. Your computer desktop screen and screensavers are hijacked by annoying messages.
4. Your computer’s web browser Pop-up blocker becomes inadequate to prevent pop-ups taking you to crazy unwanted websites with more viruses and worms.
5. Your computer’s web browser’s default start page auto re-directs to perverted websites
6. You computer system experiences extreme slowdown as well as significantly noticeable sluggishness in performance

Win32 Autorun Worm Activities:

1. It uses various security holes in the Windows Operating System to download detrimental files wrapped with spyware, adware and malware.
2. It monitors all your system activity as well as monitors your browsing habits thus creating pop-up advertisements that follow these patterns.
3. It bypasses any computer antivirus software installed on you computer system as well appears as legitimate files for Internet access in your firewall.

Win32 Autorun Worm Virus Removal Instructions

After reading the above symptoms and identifying that your computer system has been infected with the notorious Win32 Autorun Worm, let’s attempt to get rid of it with the following simple steps:

1. You will first have to open Windows Task Manager by pressing Ctrl + Shift + Esc keys.
2. Click on “Processes” and then click “Show Processes from All Users”.
3. Right-click “Run.exe” and select “End Process”.
4. Right-click “Svchost.exe” and select “End Process”.
5. Close Windows Task Manager.

Deleting all Win32 Autorun Worm related Windows Registry entries:

1. Let’s first open the Windows Registry Editor by typing the command “regedit” in the “Search Programs and Files” box and then hitting ”Enter.”
2. Delete the following registry entry manually:
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run”
3. Finally close the Windows Registry Editor and you are done here.

Deleting all Win32 Autorun related files from your computer system:

1. So let’s get this pain in the back out of our computer permanently by clicking the Windows Start Menu and then “Search Programs and Files”.
2. Search and delete all of the following files and don’t forget to permanently delete them by hitting shif+delete keys together:
- “SystemDrive\Run.exe”
- “SystemDrive\autorun.inf”
- “Programfiles\Internet Explorer\iesettings.ceb”
- “Programfiles\Internet Explorer\svchost.exe”
3. Finally, restart your computer and you should be done away with the Win32 Autorun Worm forever until you end up surfing the Internet without proper antivirus and worm protection or connected unscanned hardware such as hard disks and USB drives to your computer.

Source: devicemag.com

How to remove Wireshark Antivirus (Virus Removal Tutorial)

The Wireshark Antivirus is a rogue anti-spyware program (we’ll stick to the virus name, although it’s not its textbook definition) that mimics the behavior of legitimate antivirus software. The purpose is to convince you that your computer has a virus/security problem so that you pay money to have these viruses removed. The trick is that Wireshark Antivirus is the actual infection in your computer and that instead of giving your credit card number to these criminals, the only thing you need to do is remove Wireshark Antivirus using the removal guide below.

Wireshark Antivirus gets on your computer when you download an infected image, browsed infected porn sites and such. Once installed, the virus will be programmed to start when your Windows OS loads. Once on your computer, it will perform a fake virus scan and tell you that your computer is infected. Then the Wireshark Antivirus tells you that you have to pay for the full version to remove these infections. Remember that Wireshark Antivirus is actually the virus itself and that you shouldn’t pay that money under any circumstances.

How To Remove Wireshack- Steps

Ok, so now that you have a brief idea of what Wireshark Antivirus is, let’s learn how to remove Wireshark Antivirus completely free, by following our simple removal guide.

Please remember that each step is equally important.

Step 1. Because Wireshark Antivirus might mess with your Internet connection, you might have to download the tools we are going to use on another computer and then transfer them to the desktop of the infected computer using a CD/DVD or an USB stick.

The files we are going to need are:

Malwarebytes Anti-Malware – MBAM will scan your computer for any viruses and remove them

iExplore.exe – A great tool developed by Lawrence Abrams. It will stop the Wireshark Antivirus process (close it for good), so we can remove it.

Step 2. Once you transferred the files, it’s time to close Wireshark Antivirus so that we can remove it. Because Wireshark Antivirus will not go away easily, we are going to use eXplore.exe to kill the process. Run eXplore.exe until Wireshark Antivirus is gone. If it doesn’t work the first time, try running it multiple times simultaneously. It might not work at first, but keep going at it, as the WiresharkAntivirus virus will eventually be closed.

Step 3. Now that we have closed Wireshark Antivirus, we should remove it (and any related files). For this, we will use Malwarebytes’ Anti-Malware. Run the setup from the desktop, and proceed with the standard MBAM install settings (remember to check the “automatically update MBAM” box).

Step 4. When MBAM is up and running, go to “Scanner” and perform a full scan of your computer. Don’t worry, the scan is supposed to take quite a while, but that’s a price you should be willing to pay. When the scan is complete, check all the infections MBAM detected and select “remove selected”. Now wait for MBAM to remove WiresharkAntivirus (as well as other infections it detected) from your computer.

Step 5. Now I would suggest you use CCleaner to remove all temporary files from your computer. This is a trick I use each time I’m trying to remove a virus from an infected computer. Here is a tutorial on how to do that.

Step 6 (OPTIONAL): If you really want to be sure you got the little bugger out for good, I recommend that you use another malware removal tool, called SuperAntiSpyware. You can download the free edition here. Just install it and perform a scan. If it catches anything, remove it.

At this point, you should have removed Wireshark Antivirus and any related files from your computer. Leave a comment if anything went wrong and I’ll get back to you as soon as possible.

Source: free-pc-guides.com

USB Malware Flaw Hits Windows

A new type of malware is targeting Microsoft operating systems via infected USB drives.

The newly discovered Stuxnet malware uses a flaw in Windows to infect PCs using shortcut icons, Microsoft said.

"The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut," Microsoft said in a security warning. "This vulnerability is most likely to be exploited through removable drives."

"Currently, we have seen only limited, targeted attacks on this vulnerability," Microsoft added, but said it expects other malware writers to start using the USB shortcut flaw too.

Security firm Trend Micro agreed. "Despite the numerous potential techniques for proliferation being offered by the web, USB malware continue to be distributed by cybercriminals, which only proves their effectiveness," JM Hipolito wrote on the Trend Micro blog.

The flaw affects Windows OSes from XP to 7, as well as Server 2003 and 2008. Microsoft has issued a pair of workarounds, advising users to disable the icon for shortcuts or the WebClient service, which it sees as the "most likely remote attack vector."

Source: pcpro.co.uk