Alpha Antivirus

23 September 2009 Rogue 43 Comments

Alpha Antivirus is a fake security program that purposely displays false security alerts and scan reports to mislead computer users into purchasing the registered version of this bogus program. Alpha Antivirus aggressively pop-ups fake alert messages to gain trust and promote itself as the only software capable of removing earlier detected threats.

Infection of Alpha Antivirus is ordinarily acquired from malicious website that automatically downloads and executes a copy of this rogue program on visitor’s computer. Usually it is accompanied by Trojan with solitary role of keeping the unwanted program intact and avoiding it ejection. Trojan has a tendency to end security-related process belonging to antivirus and firewall programs installed causing Alpha Antivirus to setup on computers secretly.

In case of infection, remove Alpha Antivirus immediately along with associated Trojan, malicious files and registry entries. It may not be designed to multiply and spread across other computers but its harmful intention is disclosed when it begins to download other malware coming from an attached server. Included on this page is Alpha Antivirus removal tool that you can user to get rid of this unwanted program.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

View More

Characteristics (Analysis)
Alpha Antivirus is a rogue program. Unlike Trojans and viruses, rogues do not reproduce once it enters the system. They usually propagate by means of another Trojan infection, fake security web sites, bogus software updates and cracked programs. When executed, Alpha Antivirus instantly alters Windows registry to gain a spot on start-up process. Then, the rogue program will disable system tools like task manager, registry editor and folder options to avert own removal.

Malware Behavior

Added Registry Entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run "AlphaAnt"
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "AlphaAV"
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A77D3539-581D-450C-9E44-A84C415A6172}
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "WinNT-PAI 05.10.2009"
HKCU\Software\Microsoft\Windows\CurrentVersion\uninstall\AlphaAnt
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform "WinTSI 15.11.2009"
Associated Files and Folders:
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AlphaAnt.lnk
%UserProfile%\Desktop\Alpha Antivirus.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Alpha Antivirus.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Computer Scan.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Help.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Registration.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Security Center.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Settings.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAnt\Update.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Alpha Antivirus.lnk
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Uninstall.lnk
C:\Documents and Settings\Bleeping\Desktop\Alpha Antivirus.lnk
C:\Program Files\Common Files\Uninstall\AlphaAV\Uninstall.lnk
C:\WINDOWS\system32\msnaoladdon.dll
C:\Program Files\AlphaAnt\alpha.exe
C:\Program Files\Common Files\AlphaAntUninstall\Uninstall.lnk
C:\WINDOWS\system32\ExplorerImages.dll

How to Remove Alpha Antivirus

1. Kill any running process that belongs to Alpha Antivirus.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
alpha.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKLME\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "AlphaAV"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Alpha Antivirus.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of Alpha Antivirus

In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.