Eco Antivirus

19 November 2009 Rogue 7 Comments

Eco Antivirus with alias Eco AV and Eco Antivirus 2010 is another version of the previously released program in the same concept. Eco Antivirus seems to protect computer and the environment at the same time by integrating a nature-sound, ecosystem title with it. The software promises to donate a certain portion of the revenue for every purchased a user made. This new trick is employed by Eco Antivirus authors to discriminate this version from vast numbers of traditional rogue programs.

After installing Eco Antivirus 2010 on computer, it shortly exhibits numerous security pop-up alerts. It performs virus scan that enumerate dozens of detected threats. The main objective is to confuse victim on the real security state of the system. Insisting that computer is under virus attack, Eco Antivirus recommends defending the system with the registered version. All of these are part of its dishonest marketing scheme.

Any attempt to remove threat using the fake program will direct computer user to Eco Antivirus 2010’s payment processing website, the final pace of this fraudulent online activity.

Screen Shot Image:

Eco Antivirus 2010

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Show More Details

Characteristics (Analysis)
Eco Antivirus 2010 is a rogue security application. Not like Trojans and viruses, counterfeit software do not replicate once executed on the system. They usually spread in a way that another Trojan is involved. When run on the computer, Eco Antivirus 2010 will modify Windows registry to run itself when Windows starts. It is also responsible for disabling system tools like task manager, registry editor and folder options to avoid own removal.

Malware Behavior
Eco Antivirus 2010’s presence on system will bring a bunch of displeasure including excessive pop-up alerts that displays fake security warnings like these:

Internal conflict alert.
Eco AntiVirus detected internal software conflict. Some application tries to get access to system kernel (such behavior is typical to Spyware/Malware). It may cause crash of your computer.
Eco AntiVirus has automatically analyzed your computer for virus and other malware.

Privacy Violation alert!
Eco AntiVirus detected a Privacy Violation. A program is secretly sending your private data to an untrusted Internet host. click here to block this activity by removing the threat (Recommended).

Added Registry Entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "mxcll" 
HKCU\Software\ECO
HKLM\SOFTWARE\Eco
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKLM\SYSTEM\ControlSet002\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}\S
HKCR\AppID\{29256442-2C14-48CA-B756-3EE0F8BDC774}
HKCR\AppID\WStech.DLL
HKCR\CLSID\{A5DBD8CB-DF8A-4992-A655-B155216F6AFB}
HKCR\Interface\{051C9A06-FB08-486F-B09B-8B33B261637D}
HKCR\TypeLib\{512E801E-2F02-4ADE-ACAA-58F08A22B2F8}
HKCR\WStech.WStechB
HKCR\WStech.WStechB.1
Associated Files and Folders:
C:\Documents and Settings\All Users\Application Data\eca\Base.dat
C:\Documents and Settings\All Users\Application Data\eca\msdl.exe
C:\Documents and Settings\All Users\Application Data\eca\msll.exe
C:\Documents and Settings\All Users\Application Data\eca\vec.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\Machine\WStech.dll
C:\Documents and Settings\All Users\Start Menu\Programs\ Eco AntiVirus
C:\Documents and Settings\All Users\Desktop\ Eco AntiVirus .lnk

How to Remove Eco Antivirus

1. Kill any running process that belongs to Eco Antivirus 2010.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
vec.exe, mxcll.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "mxcll"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Eco Antivirus 2010.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of Eco Antivirus 2010

In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.