Antivirus Pro 2010

6 September 2009 Rogue 0 Comment

Antivirus Pro 2010 with alias AntivirusPro 2010 is a fake security program that spreads on scam websites wherein it can download and install a copy of itself on visitor’s computer. When successfully contracted a computer, it will excessively display alert messages and pop ups to trick computer users and push them into purchasing the registered version of Antivirus Pro 2010. All “Remove” buttons on its messages and virus scanner all leads to a payment website ready to take money from users in exchange of a useless program.

It is a common knowledge for innocent victim to acquire a program they believed can protect their computer; this is why rogue program developers are having success employing this method repeatedly. To remove Antivirus Pro 2010 from infected computer, you must run a virus scan using a legitimate anti-malware program. A relevant Trojan, files, registry entries can be detected by this program that ordinary antivirus cannot.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)

Antivirus Pro 2010 will modify Internet browser settings to redirect requested web page to the following addresses:

• utka3medrdosubor.com
• a-vpro21.com
• av-pro-2010.com
• antivirusp2010 com
• ntivirusp-2010 com
• avirus2010 com
• antivirus-pro-2010 com
• kolinhopewaqs com
• kasongskertub com
• tahulavubgmbak com
• elxolisdonave com
• nulcdiborkawer com
• lionglenhrvoa com
• buhervadonuska com
• rdafergfvacex com
• afedodevascevo com

Added Registry Entries:

HKLM\SOFTWARE\AntivirusPro_2010
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Pro 2010" 
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusPro_2010
HKCU\Control Panel\don't load "scui.cpl"
HKCU\Control Panel\don't load "wscui.cpl"

Associated Files and Folders:

C:\Documents and Settings\All Users\Documents\usurav.lib
C:\WINDOWS\bawuge._dl
C:\WINDOWS\bezonyx.ban
C:\WINDOWS\hyeikdpcd.bin
C:\WINDOWS\ruja.dl
C:\WINDOWS\system32\_scui.cpl
C:\WINDOWS\system32\epivafym._dl
C:\WINDOWS\system32\pocec.lib 
%UserProfile%\Application Data\azuloge.scr
%UserProfile%\Application Data\efenyrygi.dl
%UserProfile%\Application Data\sonisozivo.vbs
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
%UserProfile%\Desktop\AntivirusPro_2010.lnk
%UserProfile%\Local Settings\Application Data\oplmwysd.reg
%UserProfile%\Local Settings\Application Data\yvolij.dll
%UserProfile%\Local Settings\Application Data\dfqpe.exe
%UserProfile%\Start Menu\Programs\AntivirusPro_2010
%UserProfile%\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk
%UserProfile%\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk
C:\Program Files\AntivirusPro_2010
C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.cfg
C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe
C:\Program Files\AntivirusPro_2010\AVEngn.dll
C:\Program Files\AntivirusPro_2010\htmlayout.dll
C:\Program Files\AntivirusPro_2010\pthreadVC2.dll
C:\Program Files\AntivirusPro_2010\Uninstall.exe
C:\Program Files\Common Files\aqicituzap.pif
C:\Program Files\Common Files\fijunuso.inf
C:\Program Files\Common Files\goke.scr

 

 

1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of Antivirus Pro 2010

3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.

4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.

Online Virus Scanner:

Another way to remove Antivirus Pro 2010 without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found here or on websites of legitimate anti-virus and security provider.

5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished you may now restart the computer in normal mode.

Automatic Removal of Antivirus Pro 2010

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.