PC-AntiSpyware

28 March 2008 Unwanted Program 4 Comments

PC-AntiSpyware is a fake security application that requires manual installation from user to be installed inside the computer. This program may come embedded with another shareware program which can be downloaded from various web sites for free. If PC-AntiSpyware is loaded, it begins to drop several files on various folders including System directories. The malware also adds registry entry to run itself every time Windows starts.

When completely installed, PC-AntiSpyware initiates a virus scan and detects a number of spyware objects on its scan reports. The user is then advice to remove these threats by acquiring the full license version of this program first. Without the serial code, PC-AntiSpyware will not proceed with the removal and carry on its usual behavior of detecting non-existing threats that users may find annoying.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

Characteristics (Analysis)
PC-AntiSpyware is a rogue security product. Its primary purpose is to mislead victims with a number of tactics including detection of non-existent computer threats and posting of falsified scan reports.

Although this program is considered as a security risk, it is very much dissimilar to viruses and Trojans. PC-AntiSpyware do not reproduce once executed. It does not infect other files on the system or even on networked computers.

Added Registry Entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"PC-Antispyware" = ""C:\Program Files\PC-Antispyware\PC-Antispyware.exe" hide"

Associated Files and Folders:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\.protected
C:\Documents and Settings\All Users\Start Menu\Programs\PC-Antispyware\PC-Antispyware Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PC-Antispyware\PC-Antispyware.lnk
%UserProfile%\Application Data\PC-Antispyware\config.xml
%UserProfile%\Application Data\PC-Antispyware\logs\1205156013.log
%UserProfile%\Application Data\PC-Antispyware\Sites.bl
%UserProfile%\Local Settings\Temp\[RANDOM CHARACTERS].tmp
%UserProfile%\Start Menu\Programs\Startup\.protected
%ProgramFiles%\PC-Antispyware\IeExtension.dll
%ProgramFiles%\PC-Antispyware\PC-Antispyware.db
%ProgramFiles%\PC-Antispyware\PC-Antispyware.exe
%ProgramFiles%\PC-Antispyware\pcantispyware.pkg
%ProgramFiles%\PC-Antispyware\PopupBlocker.dll
%ProgramFiles%\PC-Antispyware\program.info
%ProgramFiles%\PC-Antispyware\Uninstall.exe
%System%\drivers\etc\.protected
%Windìr%\.protected
%SystemDrive%\.protected

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.