FrEn

E-mail Print PDF

XP AntiSpyware 2009 Remover

Written by Administrator  |  Thursday, 17 September 2009 18:34
AddThis Social Bookmark Button

The virus prompts you to download itself and install automatically without your approval as soon as you visit certain sites. Once installation is complete, you will not be able to remove without the help of another program. It displays a false alarm warning you that you are infected by a virus and you need XP AntiSpyware 2009 to disinfect.

The virus can also be downloaded and installed automatically by braviax, a virus of the same author.

The virus prompts you to download itself and install automatically without your approval as soon as you visit certain sites. Once installation is complete, you will not be able to remove without the help of another program. It displays a false alarm warning you that you are infected by a virus and you need XP AntiSpyware 2009 to disinfect.

The virus can also be downloaded and installed automatically by braviax, a virus of the same author.

Files created by the virus :

  • <AppData_AllUsers>\boveketuz.inf
  • <AppData_AllUsers>\duvuja.lib
  • <AppData_AllUsers>\koqisybi.bat
  • <AppData_AllUsers>\ucozoma.reg
  • <Documents>\jyxigifo._sy
  • <Documents>\ysix._dl
  • <AppData>\mepa.com
  • <AppData>\Microsoft\Internet Explorer\Quick Launch\XP_AntiSpyware.lnk
  • <Cookies>\guwysa.dat
  • <Cookies>\sasu.bat
  • <Desktop>\XP_AntiSpyware.lnk
  • <Desktop>\Antivirus 2009.lnk
  • <AppData>\jyxot.dl
  • <AppData>\mivekely._sy
  • <AppData>\pozik.vbs
  • <AppData>\wosi.vbs
  • <Programs>\Antivirus 2009
  • <Programs>\Antivirus 2009\Uninstall Antivirus 2009.lnk
  • <Programs>\XP_AntiSpyware
  • <Programs>\XP_AntiSpyware\Uninstall.lnk
  • <Programs>\XP_AntiSpyware\XP_AntiSpyware.lnk
  • <Common Files>\gykyr.bat
  • <Common Files>\ogumy.lib
  • <Common Files>\uwolykiw.com
  • <ProgramsFiles>\XP_AntiSpyware\AVEngn.dll
  • <ProgramsFiles>\XP_AntiSpyware\comp.dat
  • <ProgramsFiles>\XP_AntiSpyware\htmlayout.dll
  • <ProgramsFiles>\XP_AntiSpyware\pthreadVC2.dll
  • <ProgramsFiles>\XP_AntiSpyware\Uninstall.exe
  • <ProgramsFiles>\XP_AntiSpyware\wscui.cpl
  • <ProgramsFiles>\XP_AntiSpyware\XP_Antispyware.cfg
  • <ProgramsFiles>\XP_AntiSpyware\XP_AntiSpyware.exe
  • <ProgramsFiles>\XP_AntiSpyware\data
  • <ProgramsFiles>\XP_AntiSpyware\data\daily.cvd
  • <WINDOWS>\akikuvopa.dll
  • <Windows>\lydumyhery.scr
  • <Windows>\radimup.lib
  • <Windows>\toli.pif
  • <System>\_scui.cpl
  • <System>\oxatymy.dl
  • <System>\ieupdates.exe.tmp

Registry

  • Created key :
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XP_AntiSpyware

 

  • Created values :
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XP_AntiSpyware]
    • DisplayName = "XP Antispyware 2009"
    • UninstallString = "%ProgramFiles%\XP_AntiSpyware\Uninstall.exe"
  • [HKEY_CURRENT_USER\Control Panel\don't load]
    • scui.cpl = "No"
    • wscui.cpl = "No"
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    • ForceClassicControlPanel = 0x00000001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • XP Antispyware 2009="C:\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe" /hide
    • ieupdate = "C:\Program Files\XP Antivirus 2009\av2009.exe"

ATTENTION

If sites offer download files without plugins or whether you manually do not, unless plugins already considered reliable as Adobe Flash Player. Make blunder when you visit pornographic sites or sites of cracks or hacks.
If programs unknown warn you that you have virus in your PC and you need a program to eradicate it, do not. Be careful!

This virus tries to connect to the address: do-monster-scan.com and do the request: update_inst.php? Wmid = 1054 & subid = ddb4029157966bcdf2161c8652ae61c5 & pid = 33 & lid = 2 & hs = 8DACE879D696BAB83E325E6D77E30E17 which attempts to download files from one of the Address bellow:

  • http://www.xp-antispyware2009.com/
  • http://www.xp-antispyware-2009.com/
  • http://www.xpantispyware-2009.com/
  • http://www.xpas2009.com/
  • http://www.xp-as-2009.com/

Link of download:

  • http://www.xp-antispyware2009.com/binary/Binaries1.cab
  • http://www.xp-antispyware2009.com/binary/Binaries2.cab
  • http://www.xp-antispyware2009.com/binary/Binaries3.cab
  • http://www.xp-antispyware2009.com/binary/Binaries4.cab
  • http://www.xp-antispyware2009.com/binary/Binaries5.cab

 

Add comment


Security code
Refresh

Related articles
Latest posts
Free malware removal tool to remove Total Vista Security
_WRITTEN_BY Administrator 16/03/2010
Total Vista Security is a rogue antispyware that may reprensent security risk for your system, it's a malware that pretends to be an Antivirus. Total Vista Security conducts a fake scan of your…Read more...
Free malware removal tool to remove Virus Protector
_WRITTEN_BY Administrator 15/03/2010

Virus Protector is a rogue Antispyware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that there are…Read more...

Free malware removal tool to remove Dr. Guard
_WRITTEN_BY Administrator 01/03/2010
Dr. Guard is a rogue Antispyware from the Paladin Antivirus Family, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are…Read more...
Free malware removal tool to remove Paladin Antivirus
_WRITTEN_BY Administrator 27/02/2010
Paladin Antivirus is a rogue Antispyware, a scareware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a…Read more...
Free malware removal tool to remove PC Defender
_WRITTEN_BY Administrator 24/02/2010
PC Defender is a rogue Antispyware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that…Read more...
.
Information | Contact

© All Rights Reserved. net-studio.org 2009