AntiMalware GO

27 February 2011 Rogue 1 Comment

AntiMalware GO is a variant of rogue anti-virus application that belongs to a group where Antivirus .Net have originated. With the same scheme, it is expected that AntiMalware GO will be as deadly as its previous released. Security experts advised to avoid unknown websites, downloading files from file-sharing networks and clicking on link from unknown contacts on instant messaging programs to prevent AntiMalware GO virus infection.

If AntiMalware GO is installed on the system, it will make several changes including alterations on Internet browser’s home page settings. This malware will also reduced security settings by disabling resources found associate to legitimate security applications. Locally installed application will be prevented from executing and will be stated as contracted with some form of Trojan.

Fake AV application such as AntiMalware GO must be removed immediately from the computer. It can be deleted by scanning the computer with the recommended software stated below that has proven to remove a majority of fake anti-virus.

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

AntiMalware GO Removal Procedures

Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “AntiMalware GO”. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
(random characters).exe

2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to AntiMalware GO Virus.
4. Registry entries created by AntiMalware GO must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of AntiMalware GO start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
(random characters).exe

7. Click Apply and restart Windows.

AntiMalware GO Removal Tool:
In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Scan with Portable Antivirus:
Most of the time, Trojan associated with a rogue program will disable Windows functionalities and prevent execution of any application including antivirus program locally installed. If this happens, you can try using a McAfee Portable Antivirus called Stinger. You can download it for free.

Technical Details and Additional Information:

Malicious Files Added by AntiMalware GO:
%Temp%\[random]\
%Temp%\[random]\[random].exe

AntiMalware GO Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\[random] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter “Enabled” = “0?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyOverride” = “”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1:18810?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyEnable” = “1?