Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010

2 February 2010 Rogue 1 Comment

Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 are misleading security program created for Windows Vista platform. Experts learned that Antivirus Vista 2010 is part of a large group of rogue security program that adapts seamlessly to victims operating system to masquerade this program as part of the system. Antivirus Vista 2010 is qualified to perform various system modifications. It creates own value on the Windows registry that will allow the threat to run each boot-up. This start-up process severely affects the condition of installed software particularly those that are security-related. Antivirus Vista 2010 will obstruct the functionalities of anti-virus and firewall programs.

Moreover, Antivirus Vista 2010 can bring other harm to affected machine such as Internet access blocking, browser redirects and making Windows utilities unusable. Aside from that, this pretentious virus can further harm a computer by downloading additional malicious files from a remote server and executing it without user’s intervention.

Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 are types of program that you must get rid urgently. This is so dangerous that it can bring complete malfunction to the infected PC.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

[expand title="Show More Details" swaptitle="Hide Details"]

Characteristics (Analysis)
Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 are fraud security programs. Installing these potentially unwanted applications on computer without user’s knowledge is definitely possible with the assistance of Trojan Downloader. None of these rogue programs and connected Trojan replicate on their own. These types of malware do not infect nearby computers as well. The main objective of these fake anti-virus applications is to persuade users into paying for the registered version. In short, all of the activities perpetuated are part of the whole operation to make user contribute in these income-generating activities.

Added Registry Entries:

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKLM\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKLM\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1" 
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKCU\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCU\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCR\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCR\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCU\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCU\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCR\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCR\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*

Associated Files and Folders:

C:\ProgramData\POjdu8wuTU2
C:\Users\All Users\POjdu8wuTU2
%UserProfile%\AppData\Local\av.exe
%UserProfile%\AppData\Local\ave.exe
%UserProfile%\AppData\Local\POjdu8wuTU2
%UserProfile%\AppData\Local\WRblt8464P
%UserProfile%\AppData\Local\Temp\POjdu8wuTU2
%UserProfile%\AppData\Roaming\Microsoft\Windows\Templates\POjdu8wuTU2

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to Antivirus Vista 2010.
10. Restart your computer.

Note: If Antivirus Vista 2010, Vista Smart Security 2010, Vista AntiMalware 2010 and Vista Security Tool 2010 prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.