Security Antivirus
Security Antivirus is another bogus security application created for Windows platform. It attempts to scam computer users while authors behind this attack aspires to earn a profit from this fraudulent activity. Security Antivirus is nothing but a useless program designed to install itself on computer without user’s consent. While inside the system, Security Antivirus will generate numerous alerts and warning messages stating that the computer is critically infected with viruses. At this point, it will advise user for urgent activation to remove threats and to benefit from Security Antivirus’ ultimate protection. Its claims have no evidential support, in fact it was categorized as rogue program because its components does not contain necessary database and essential files to remove virus and protect a computer from various attacks.
It was also clear that rogue programs like Security Antivirus has no capability to remove viruses and protect a computer from threats. Its modules were incomplete to perform as such. However, it can run a virus scan on affected machine, but that does not match the real inspection conducted by legitimate virus scanners. All that Security Antivirus provides is purely an animated sequence, revealing nothing but manufactured scan results.
We strongly recommend removing Security Antivirus immediately from computer before it can further harm the system.
Screen Shot Image:
Technical Details and Additional Information:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista
Characteristics (Analysis)
This potentially unwanted application runs every time Windows starts by adding the following registration entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Security Antivirus”
Malware Behavior
While Security Antivirus is operating inside the infected computer, it generates annoying pop-up alerts. So many of these warnings occupies screen as an effort to convince victims that a number of virus infections may endanger the system. Additionally, Security Antivirus repeatedly prompts to register the software so that it may begin the removal process of detected threats.
One of the sample warning provided by this rogue program will contain the following alert message:
Warning! Spambot detected!
Attention! A spambot sending viruses to your e-mail contacts has been detected on your PC.
HKEY_CURRENT_USER\Software\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Security Antivirus"
HKEY_CLASSES_ROOT\SA345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala .com/?&uid=195&q={searchTerms}"
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala .com/?&uid=195&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" ="http: //127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "App/7.00195"
Associated Files and Folders:C:\Documents and Settings\All Users\Application Data\231h447\mozcrt19.dll C:\Documents and Settings\All Users\Application Data\231h447\SA345d.exe C:\Documents and Settings\All Users\Application Data\231h447\sqlite3.dll C:\Documents and Settings\All Users\Application Data\231h447\BackUp\Adobe Reader Speed Launch.lnk C:\Documents and Settings\All Users\Application Data\231h447\BackUp\Adobe Reader Synchronizer.lnk C:\Documents and Settings\All Users\Application Data\SADFIOPODIV\SAAKDUPV.cfg %UserProfile%\Application Data\Security Antivirus %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Antivirus.lnk %UserProfile%\Application Data\Security Antivirus\cookies.sqlite %UserProfile%\Desktop\Security Antivirus.lnk %UserProfile%\Recent\ANTIGEN.drv %UserProfile%\Recent\ANTIGEN.exe %UserProfile%\Recent\cid.dll %UserProfile%\Recent\CLSV.drv %UserProfile%\Recent\DBOLE.sys %UserProfile%\Recent\ddv.dll %UserProfile%\Recent\ddv.sys %UserProfile%\Recent\energy.tmp %UserProfile%\Recent\FS.drv %UserProfile%\Recent\gid.drv %UserProfile%\Recent\PE.drv %UserProfile%\Recent\PE.exe %UserProfile%\Recent\PE.sys %UserProfile%\Recent\PE.tmp %UserProfile%\Recent\runddlkey.dll %UserProfile%\Recent\std.exe %UserProfile%\Recent\tjd.drv %UserProfile%\Recent\tjd.sys %UserProfile%\Start Menu\Security Antivirus.lnk %UserProfile%\Start Menu\Programs\Security Antivirus.lnk C:\Program Files\Mozilla Firefox\searchplugins\search.xml
How to Remove Security Antivirus
1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of Security Antivirus
3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.
4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.
Online Virus Scanner:
Another way to remove Security Antivirus without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found on websites of legitimate anti-virus and security provider.
5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished, you may now restart the computer in normal mode.
Automatic Removal of Security Antivirus
In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.Remove Security Antivirus with Portable SuperAntiSpyware:
To thoroughly clean a computer, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Download and run SuperAntiSpyware Portable Scanner.