Shared Security Info

Internet Security 2010 Virus and Malware

PadLocked — Sat, 12 Dec 2009 01:27:18 +0000

Description of Internet Security 2010 Virus:
Internet Security 2010 Virus will scare computer users with random security alerts and warning messages. This trick is being applied by Internet Security 2010 in the hope that anxious victim will acquire the licensed version and expect to gain a revenue from this counterfeit cyber activities. Internet Security 2010 carefully sneaks onto your computer to avoid detection and penetrate deeply into your system folders to ensure that it all its files and components are totally hidden from security programs. By doing this, Internet Security 2010 will be hard to remove by simply using an automated virus scan. Removing Internet Security 2010 virus should be performed both automatically and manually to ensure that it was completely gone. Installing a legit and trusted anti-malware program as an added security can help protect from future infections.

Internet Security 2010 Virus Technical Information:
Aliases: Internet Security 2010 Trojan
Released Date: 2009
Type: Fake Antivirus
Websites:

Internet Security 2010 Virus Symptoms:
“Windows can`t play the following media formats: AVI;WMV;AVS;FLV;MKV;MOV;3GP;MP4;MPG;MPEG;MP3;AAC;WAV;WMA;CDA;FLAC;M4A;MID. Update your video and sound codec to resolve this issue.”

“Application cannot be executed. The file is infected. Please activate your antivirus software.”

“Security Warning!
Worm.Win32.NetSky detected on your machine.”

Internet Security 2010 Virus Screenshot:

Download Internet Security 2010 Virus Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of Internet Security 2010 Virus
Manual removal of Internet Security 2010 Virus requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during Internet Security 2010 Virus removal
- Internet connection is disabled while Internet Security 2010 Virus removal is in process
- Registry and legitimate system files were backed-up before proceeding to Internet Security 2010 Virus removal

Find and remove Internet Security 2010 Virus files:
c:\s
c:\Program Files\InternetSecurity2010
c:\Program Files\InternetSecurity2010\IS2010.exe
c:\WINDOWS\system32\41.exe
c:\WINDOWS\system32\winhelper86.dll
c:\WINDOWS\system32\winlogon86.exe
c:\WINDOWS\system32\winupdate86.exe
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
%UserProfile%\Desktop\Internet Security 2010.lnk
%UserProfile%\Start Menu\Internet Security 2010.lnk

Remove the following Internet Security 2010 Virus registry entries:
HKEY_CURRENT_USER\Software\IS2010
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run “Internet Security 2010″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run “winupdate86.exe”

Security Tool

PadLocked — Thu, 26 Nov 2009 09:25:46 +0000

Description of Security Tool:
Security Tool is a rogue security program that will lie about the security threats found on computer to make you believe that computer is under attack and a purchase of this program is necessary. Security Tool is the most widely-spread rogue security programs because of its vast promotional websites and Trojans already infected large number of computer worldwide. This intimidating techniques by Security Tool has so far proved to finalized a fraudulent online transactions and are downloaded and purchase by its victims. One can catch this unwanted program simply by visiting a malicious websites pretending to be an online virus scanner. If Security Tool’s presence was found on computer, remove it immediately using a legitimate security program.

Security Tool Technical Information:
Aliases: Security Tool
Released Date: 2009
Type: Fake Antivirus
Websites:

Security Tool Symptoms:
Security Tool Warning
Spyware.IEMonster activity detected. This is spyware that attempts to steal passwords from Internet Explorer, Mozilla Firefox, Outlook and other programs.
Click here to remove it immediately with SecurityTool.

Security Tool Warning
Some critical system files of your computer were modified by malicious program. It may cause system instability and data loss.
Click here to block unauthorised modification by removing threats (Recommended)

Security Tool Screenshot:

Download Security Tool Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of Security Tool
Manual removal of Security Tool requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during Security Tool removal
- Internet connection is disabled while Security Tool removal is in process
- Registry and legitimate system files were backed-up before proceeding to Security Tool removal

Find and remove Security Tool files:
%UserProfile%\Application Data\4946550101\4946550101.bat
%UserProfile%\Application Data\4946550101\4946550101.cfg
%UserProfile%\Application Data\4946550101\4946550101.exe
%UserProfile%\Desktop\Security Tool.lnk
%UserProfile%\Start Menu\Programs\Security Tool.lnk

Delete the following Security Tool directories:
%UserProfile%\Application Data\4946550101

Remove the following Security Tool registry entries:
HKEY_CURRENT_USER\Software\Security Tool
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “4946550101″

Alpha Antivirus – Removal

PadLocked — Thu, 26 Nov 2009 08:55:42 +0000

Description of Alpha Antivirus:
Alpha Antivirus is a deceiving security program that will purposely shows security alerts and fake system security threats to cheat you and convince that computer is heavily infected with malware and virus. Alpha Antivirus uses a console that is very similar to other rogue programs so this is an assurance that it is another variants of Personal Antivirus. If this malicious software is installed, it will mention a lists of computer infections and advise you to get the full version from its website, to be able to have the Alpha Antivirus code and serial number, a certain amount has to be paid. This program should not be purchase, beside Alpha Antivirus removal procedure must be carried out once a symptoms was noticed on your computer.

Alpha Antivirus Technical Information:
Aliases: Alpha Antivirus, Alpha AV
Released Date: 2009
Type: Fake Antivirus
Websites: -

Alpha Antivirus Screenshot:

Download Alpha Antivirus Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of Alpha Antivirus
Manual removal of Alpha Antivirus requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during Alpha Antivirus removal
- Internet connection is disabled while Alpha Antivirus removal is in process
- Registry and legitimate system files were backed-up before proceeding to Alpha Antivirus removal

Find and remove Alpha Antivirus files:
AlphaAV.exe, msnaoladdon.dll, Alpha Antivirus.lnk, NetFilter.exe, ndisapi.dll, NDISRD.sys

Delete the following Alpha Antivirus directories:
%Program Files%\Alpha Antivirus
%Documents and Settings%\All Users\Start Menu\Programs\Alpha Antivirus
%Documents and Settings%\All Users\Application Data\Alpha Antivirus

Remove the following Alpha Antivirus registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “AlphaAV”
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “Alpha Antivirus”
HKEY_LOCAL_MACHINE\Software\Alpha Antivirus
HKEY_CURRENT_USER\Software\Alpha Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Alpha Antivirus
%UserProfile%\Desktop\Alpha Antivirus.lnk

Control Center – Virus Removal

PadLocked — Thu, 26 Nov 2009 08:40:29 +0000

Description of Control Center:
Control Center is a rogue computer utility application from the same family as Privacy Center. This fake software is endorse through scam security websites and fake online virus scanners that were designed and made online for the sole purpose. Control Center websites will plan to deliver false information on visitors computer security status and asked them to download the installation package. When Control Center is installed the same routine will emerge and this time it will recommend the purchase of the registered version to be able to fix the detected security risks. Control Center removal is necessary at this time and having the licensed version is not an option.

Control Center Technical Information:
Aliases: ControlCenter
Released Date: 2009
Type: Fake Antivirus
Websites: -

Control Center Screenshot:

Download Control Center Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of Control Center
Manual removal of Control Center requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during Control Center removal
- Internet connection is disabled while Control Center removal is in process
- Registry and legitimate system files were backed-up before proceeding to Control Center removal

Find and remove Control Center files:
%UserProfile%\Application Data\CC
%UserProfile%\Application Data\CC\agent.exe
%UserProfile%\Application Data\CC\cc.exe
%UserProfile%\Application Data\CC\settings.ini
%UserProfile%\Application Data\CC\uninstall.exe
%UserProfile%\Application Data\CC\faq
%UserProfile%\Application Data\CC\faq\guide.html
%UserProfile%\Application Data\CC\faq\images
%UserProfile%\Application Data\CC\faq\images5.png
%UserProfile%\Application Data\CC\faq\images6.png
%UserProfile%\Application Data\CC\faq\images7.png
%UserProfile%\Application Data\CC\faq\images8.png
%UserProfile%\Application Data\CC\faq\images9.png
%UserProfile%\Application Data\CC\faq\images\10.png
%UserProfile%\Desktop\Control center.lnk

Delete the following Control Center directories:
C:\Documents and Settings\%UserName%\Application Data\CC
C:\Documents and Settings\%UserName%\Application Data\CC\faq
C:\Documents and Settings\%UserName%\Application Data\CC\faq\images

Remove the following Control Center registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Control center
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “agent.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%UserProfile%\Application Data\CC\cc.exe”

Eco Antivirus 2010 Removal

PadLocked — Thu, 26 Nov 2009 02:44:44 +0000

Description of Eco Antivirus 2010:
Eco Antivirus 2010 is a fake security program that will be dropped and installed on computer by a Trojan which have downloader functionalities. Eco Antivirus 2010 will not be noticed by users until such time that it was fully installed and displayed fake security wanrings and play its own virus scan. Eco Antivirus 2010 have various ways to elude people into purchasing the licensed version of it, and one of that is via scam websites that contains very promising text and graphics. Perform Eco Antivirus 2010 removal on computer as soon as possible if got infected.

Eco Antivirus 2010 Technical Information:
Aliases: Eco Antivirus 2010, Eco Antivirus, Eco AV
Released Date: 2009
Type: Fake Antivirus
Websites: eco-av.com

Eco Antivirus 2010 Screenshot:

Download Eco Antivirus 2010 Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of Eco Antivirus 2010
Manual removal of Eco Antivirus 2010 requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during Eco Antivirus 2010 removal
- Internet connection is disabled while Eco Antivirus 2010 removal is in process
- Registry and legitimate system files were backed-up before proceeding to Eco Antivirus 2010 removal

Find and remove Eco Antivirus 2010 files:
Base.dat msdl.exe msll.exe vec.exe WStech.dll Eco AntiVirus .lnk

Delete the following Eco Antivirus 2010 directories:
C:\Documents and Settings\All Users\Start Menu\Programs\Eco AntiVirus
C:\Documents and Settings\All Users\Application Data\eca
C:\Documents and Settings\All Users\Application Data\Microsoft\Machine

Remove the following Eco Antivirus 2010 registry entries:
HKEY_CURRENT_USER\Software\ECO
HKEY_CLASSES_ROOT\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
HKEY_CLASSES_ROOT\AppID\WStech.DLL
HKEY_CLASSES_ROOT\CLSID\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_CLASSES_ROOT\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
HKEY_CLASSES_ROOT\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
HKEY_CLASSES_ROOT\WStech.WStechB
HKEY_CLASSES_ROOT\WStech.WStechB.1
HKEY_LOCAL_MACHINE\SOFTWARE\Eco
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}\S
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “mxcll”

Rogue Program SecureWarrior

PadLocked — Sun, 04 Oct 2009 01:42:57 +0000

Description of SecureWarrior:
SecureWarrior is a new rogue that is also a member of the WiniSoft family. These type of programs was commonly installed on computers by a Trojan which can hardly be detected by antivirus programs. SecureWarrior will mislead computer users with its fake security alert messages and fake virus scan results. A removal of SecureWarrior requires thorough scanning and registry editing.

SecureWarrior Technical Information:
Aliases: SecureWarrior, Secure Warrior, Secure Warrior Malware
Released Date: 2009
Type: Fake Antivirus
Websites: -

SecureWarrior Symptoms:
Example message it may display is:
Infiltration Alert!
Your computer is being attacked by an Internet Virus. It could be password-stealing attacks, a trojan-dropper or similar.

SecureWarrior Screenshot:

Download SecureWarrior Removal Program
Download and install MalwareBytes’ Anti-Malware. This version will also help protect your computer against future threats. For a free removal tool only without protection, please click here.

Manual Removal of SecureWarrior
Manual removal of SecureWarrior requires system files and registry modifications. This can be performed with satisfactory result by having the following procedures:
- All programs are closed during SecureWarrior removal
- Internet connection is disabled while removing SecureWarrior
- Registry and legitimate system files were backed-up before removing SecureWarrior

Find and remove SecureWarrior files:
SecureWarrior.exe uninstall.exe 1025worm59bz.bin 10562spy9z1.cpl 109559dwarz959.dll 2485z5p920a.cpl 249069orm57cz.exe 25059zorm4d9.dll SecureWarrior.lnk 1 SecureWarrior.lnk 2 Homepage.lnk 3 Uninstall.lnk 0urw56p0.exe

Delete the following SecureWarrior directories:
c:\Program Files\SecureWarrior Software
c:\Program Files\SecureWarrior Software\SecureWarrior
c:\Documents and Settings\All Users\Start Menu\Programs\SecureWarrior

Remove the following SecureWarrior registry entries:
HKEY_CURRENT_USER\Software\SecureWarrior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SecureWarrior
HKEY_LOCAL_MACHINE\SOFTWARE\SecureWarrior
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREWARRIORSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecureWarriorSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “0urw56p0.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SecureWarrior”

SecurityTool Malware

PadLocked — Sat, 26 Sep 2009 10:55:56 +0000

New threats were discovered as the one that was being propagated by using a Search Engine Optimization to forward users web browser to the rogue programs’ website. First there was a Trojan that will infect computers and exhibit warning alerts about certain virus. Users first resort is to search the internet for this virus. Little did we know that the keyword for that virus was already optimized by scam websites so that search results will be redirected and download a copy of Security Tool virus on visitors computer.

Additional Rogue Programs for September 2009 end Week

PadLocked — Wed, 23 Sep 2009 12:38:37 +0000

New rogue security application discovered was Alpha Antivirus and SaveArmor for the last week of September 2009.

SaveArmor was a variant of previos programs like SaveKeeper, SaveDeep, SaveSoldier and others. While Alpha Antivirus is using a new trick of web SEO to bring users into their scam website.

Omega Antivir

PadLocked — Sun, 13 Sep 2009 08:50:53 +0000

A rogue program Omega Antivir is another released from the same group of VirusDoctor. This malware usually got into computers by exploiting software vulnerabilities that trojan targets to be able to download and install on computer without users knowledge.

SafetyKeeper is a new version of SaveKeep

PadLocked — Sat, 12 Sep 2009 01:47:31 +0000

If you have been infected with SafetyKeeper it means your antivirus program is not catching this latest variant that was previously released as SaveKeep.

These unwanted program was developed to gather fraudulent online transaction and earn from this fraudulent activities.