Antivirus 7

13 March 2010 1 Comment

Antivirus 7 is a rogue computer security application that may be acquired when visiting a websites that was designed to run a malicious scripts on visitors computer. Antivirus 7 virus will be downloaded and execute on the computer without users knowledge by exploiting certain software vulnerabilities. After installation, this fake program will display continuous alerts and warning messages that aims to trick the users into purchasing the Antivirus 7 activation code or license. A self-launched virus scan by Antivirus 7 will also be observed detecting dozens of threats. These threats are not present on computers, instead it was another misleading actions to persuade users to have the registered version of the software. After all, it will advertise that the only way to remove virus infections on computer is by having the license version of Antivirus 7.

The real solution to remove Antivirus 7, virus and other threats on computer is to download and scan with real anti-malware application. Getting the license version of Antivirus 7 will not resolve any problems. It was not designed to remove any kind of threats and was not capable of doing so.

Antivirus 7 Screen Shot:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Antivirus 7 Removal Procedures

Manual Removal:
1. Stop Antivirus 7 process by pressing Ctrl+Alt+Del. Windows Task Manager will open. Look for the following process:
(random characters).exe
avsuite.exe
avsoft.exe

2. Update your installed anti-virus program.
3. Run a full system scan and clean/delete all detected infected file(s). A manual removal of virus-related files should also be performed.
4. Edit Windows registry and delete Antivirus 7 entries. [how to edit registry]
5. Exit registry editor.
6. Remove Antivirus 7 start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
(random characters).exe
avsuite.exe
avsoft.exe

7. Click Apply and restart Windows.

Antivirus 7 Removal Tool:
In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.

Online Virus Scanner:
Another way to remove a virus without the need to install additional anti-virus application is to perform a thorough scan with free Online Virus Scanner that can be found on websites of legitimate anti-virus and security provider.

Technical Details and Additional Information:

Different warning is shown by Antivirus 7 as scare tactics to convince users to obtain the licensed version of the program. Here are some of it:

Security advisor: Important updates available
Attention! New important updates available
New important updates:
- anti-virus database definitions update
- anti-spyware database definitions updates
- critical system vulnerabilities fix
Optional updates:
- resident shield update
- Internet Explorer potential vulnerabilities fix
Recommended: Always install latest updates to enhance your computer security and performance

Resident Shield: New virus detected
Warning! New virus detected
Please click “Remove All” button to heal all infected files and protect your PC

Internet Shield: Identity theft attempt detected
56.12.121.12
Warning! Identity theft attempt detected
Please click “Prevent attack” button to heal all infected files and protect your PC

When trying to get the license of Antivirus 7, it will redirect users to their own payment-processing website and ask for credit card information to be charge. Aside from the payment, a fraudulent transaction will be made that will deduct additional fees on user’s account.

Malicious Files Added by Antivirus 7:
%Program Files\AV7
%Program Files\AV7\antivirus7.exe
%WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
%WINDOWS\system32\UpdateExplorer.dll
%UserProfile%\Desktop\Antivirus7.lnk
%Documents and Settings\All Users\Start Menu\AV7
%Documents and Settings\All Users\Start Menu\AV7\Antivirus7.lnk
%Documents and Settings\All Users\Start Menu\AV7\Uninstall.lnk

Antivirus 7 Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AV7″
HKEY_CURRENT_USER\Software\EVA246
HKEY_CLASSES_ROOT\CLSID\{E2BFE352-A303-4EA8-88FE-CE35361D7E8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2BFE352-A303-4EA8-88FE-CE35361D7E8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “WinNT-EVI 12.03.2010″

Web Sites To Avoid Belonging to Antivirus 7:
antispyware-live70 . com
antispyware-live72 . com
antispyware-live73 . com
antispyware-live76 . com
antispyware-live79 . com
red-xxx-tube . net