Live Security Suite

14 May 2010 Rogue 2 Comments

Live Security Suite is another untrusted security application that will pretend as an antivirus program created for Windows. Live Security Suite virus will be spread over the Internet by means of a Trojan and fake online virus scanner web pages. A Trojan will infect a computer that may result to browser redirection. Infected computer will be pointed to web pages that will execute a false virus scan on visitor’s computer. After the scan, it will prompt user to download and install trial version of Live Security Suite to be able to get rid of detected threats. On some instances, this application will be installed by a Trojan without your knowledge when in enters the computer via Internet browser’s vulnerabilities. Just as expected, having this program on the computer will not clean infected items. Instead, it will perform another virus scan locally. This time, it will ask users to pay the registered version to completely remove all threats. A common way for rogue programs to deceive users and earn a profit from its illegal activities.

To remove Live Security Suite and other Trojan related to it. Having the registered version of this program is unnecessary and not advisable. Why pay for the fake program when there are legitimate security tool available free. We recommend the use to trusted anti-malware application to fully scan the computer. Aside from it, anti-virus programs can also be use to remove infected files and Trojans dropped by Live Security Suite.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)

Malware Behavior
Presence of this unwanted program will annoy users with excessive fake alert messages to promote Live Security Suite and further convince users to obtain the licensed version.

Spyware activity alert!
Spyware.BrowserDeath activity detected. This kind of spyware is attempts to steal passwords from Internet Explorer, Mozilla Firefox, Opera and other programs, including logins and passwords from online banking sessions, eBay, PayPal, etc.

System Warning
Tracking cookies that steal your passwords, accounts and credit card information have been detected in your system. Click here to remove them immediately with Live Security Suite.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Live Security Suite
HKEY_LOCAL_MACHINE\SOFTWARE\Live Security Suite
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Suite_is1
HKEY_CURRENT_USER\Software\Microsoft\FTP "SearchDir" = "C:Program FilesLive Security Suite"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "uniname" = "Live Security Suite_is1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Live Security Suite"

Associated Files and Folders:

c:\Documents and Settings\All Users\Start Menu\Programs\Live Security Suite
c:\Program Files\Live Security Suite\LiveSS.exe
c:\Program Files\Live Security Suite\unins000.dat
c:\Program Files\Live Security Suite\working.log
c:\Program Files\Live Security Suite\db
c:\Program Files\Live Security Suite\db\DBInfo.ver
c:\Program Files\Live Security Suite\db\ia080614.db
c:\Program Files\Live Security Suite\db\lists.ini
c:\Program Files\Live Security Suite\db\WMILib.dll
%UserProfile%\Application Data\Live Security Suite
%UserProfile%\Application Data\Live Security Suite\settings.ini
%UserProfile%\Application Data\Live Security Suite\uill.ini
%UserProfile%\Application Data\Live Security Suite\unins000.exe
%UserProfile%\Application Data\Live Security Suite\Uninstall Live Security Suite.lnk
%UserProfile%\Application Data\Live Security Suite\db
%UserProfile%\Application Data\Live Security Suite\db\config.cfg
%UserProfile%\Application Data\Live Security Suite\db\Timeout.inf
%UserProfile%\Application Data\Live Security Suite\db\Urls.inf
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe

Live Security Suite

Manual Removal Procedure

1. Kill any running process that belongs to Live Security Suite.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
LiveSS.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Live Security Suite"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Live Security Suite.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of Live Security Suite

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.