Antivir

29 November 2009 Rogue 32 Comments

Antivir is a fake security program that will initially redirect Internet browser of the compromised computer to fake security web site. On this site, Antivir simulates a virus scan produces convincing fake results. This practice is extensively used in the operation of rogue security programs anticipating advance acceptance from users. Other than those mentioned, this bogus program tries to install itself on computers either automatically or manually by tricking users on its beneficial functionalities. Automatic installation requires Trojan’s expertise in infiltrating the system invisibly. While manual setup involves heavy encouragement from fake security alerts and Windows task bar warnings.

Antivir is not in any way connected to Avira, an established security software provider. In fact, Antivir virus is perfect impersonator. Highly distinguishable difference between the two is method of propagation. Avira Antivir is promoted on their own web site and standard online advertisements while Antivir virus is spread with the assistance of Trojan. Moreover, Antivir unexpectedly appears on computer and overruns default setup protocol. As soon as it completes loading, Internet access is blocked and provides error page containing the message:

We strongly recommend to discontinue the use of this website. This website has been reported to Microsoft for containing threats that might steal personal or financial information from your computer.

Warning! Visiting this site may harm your computer!
This web site probably contains malicious software program, which can cause damage to your computer or perform actions without your permission. Your computer may be infected after visiting such web site. 

To remove Antivir, reliable security application must be used. Avoid having Antivir to remove any threats on computer since already realized that rogue programs has no security module to do such task.

Antivir Screen Shot:

Antivir

Alias: Antivir Virus

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

Antivir Removal Procedures

Manual Removal:
1. Stop Antivir process by pressing Ctrl+Alt+Del. Windows Task Manager will open. Look for the following process:
antivir.exe

2. Update your installed anti-virus program.

3. Run a full system scan and clean/delete all detected infected file(s). A manual removal of virus-related files should also be performed.

4. Edit Windows registry and delete Antivir entries.
- For Windows 2000/XP: Go to Start > Run, type “regedit” on dialog box then press Enter on keyboard.
- For Windows Vista/7: Go to Start > Search Program and Files, type “regedit” and press Enter.

5. Exit registry editor.

6. Remove Antivir start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
antivir.exe

7. Click Apply and restart Windows.

Antivir Removal Tool:

Entirely removing Antivir virus does not require complicated process. Only one program is required to eliminate presence of fake security application. In fact, some lenient infection contains “uninstall.exe” file which is sufficient to remove unwanted software. If in case the file is missing, download a copy of Malwarebytes Anti-Malware and install with default settings. Run a thorough scan of the compromised unit and be sure to delete all detected threats.

Using free version of legitimate Online Virus Scanner can help remove other threats not detected by installed security program. This tool can be used to identify hidden threats without
the need to install separate anti-virus application.

Technical Details and Additional Information: 

Malicious Files Added by Antivir:
C:\Program Files\AV\antivir.exe
C:\Program Files\AV\UpdateCheck.dll
C:\Program Files\Common Files\Uninstall
C:\Program Files\Common Files\Uninstall\AV
C:\Documents and Settings\All Users\Start Menu\AV

Antivir Registry Entries:
HKEY_CURRENT_USER\Software\EVAACD
HKEY_CLASSES_ROOT\CLSID\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AV”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform “WinNT-EVI 25.11.2009″