Unvirex!gen1
Unvirex!gen1 is a generic detection that were used to identify security risk that were related to Unvirex family of rogue programs. Unvirex!gen1 is considered as a rogue application that will pretend to be a legitimate anti-virus program. It will automatically launched a system scan and provide falsified results in order to push victims into obtaining the licensed version of the endorsed application.
Screen Shot Image:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
Unvirex!gen1 Removal Procedures
Manual Removal:
1. Press Ctrl+Alt+Del on keyboard to stop process associated to “Unvirex!gen1″. When Windows Task Manager opens, go to Processes Tab and find and end the following process:
UnVirex.exe
2. You need to update your installed antivirus application to have the latest database.
3. Thoroughly scan the computer and any detected threats must be removed. If removal is prohibited, it is best to quarantine the infected item. Manually locating and deleting of malicious files should also be performed. Please see files below that are related to Unvirex!gen1 Virus.
4. Registry entries created by Unvirex!gen1 must also be remove from the Windows system. Please refer below for entries associated to the rogue program. [how to edit registry]
5. Exit registry editor.
6. Get rid of Unvirex!gen1 start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. A windows containing System Configuration Utility will be launched. Go to Startup tab and uncheck the following Start-up item(s):
UnVirex.exe
7. Click Apply and restart Windows.
Unvirex!gen1 Removal Tool:
In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.
Using Portable SuperAntiSpyware:
To thoroughly remove the virus, it is best to do a separate scan of another security program so that other infected files not detected by anti-virus application can be remove as well. Download and run SuperAntiSpyware Portable Scanner.
Technical Details and Additional Information:
Malicious Files Added by Unvirex!gen1:
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\UnVirex.lnk
%UserProfile%\Local Settings\Temp\[RANDOM CHARACTERS]\ext.dll
%UserProfile%\Local Settings\Temp\[RANDOM CHARACTERS]\System.dll
%ProgramFiles%\UnVirex\daily.cvd
%ProgramFiles%\UnVirex\Drvfltip.sys
%ProgramFiles%\UnVirex\hjengine.dll
%ProgramFiles%\UnVirex\IEAddon.dll
%ProgramFiles%\UnVirex\main.cvd
%ProgramFiles%\UnVirex\MFC71.dll
%ProgramFiles%\UnVirex\MFC71ENU.DLL
%ProgramFiles%\UnVirex\msvcp71.dll
%ProgramFiles%\UnVirex\msvcr71.dll
%ProgramFiles%\UnVirex\pthreadVC2.dll
%ProgramFiles%\UnVirex\siglsp.dll
%ProgramFiles%\UnVirex\uninstall.exe
%ProgramFiles%\UnVirex\UnVirex.exe
Unvirex!gen1 Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”UnVirex” = “C:\Program Files\UnVirex\UnVirex.exe”
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\00000001\”PackedCatalogItem” = “%ProgramFiles%\UnVirex\siglsp.dll”
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000013\”PackedCatalogItem” = “%ProgramFiles%\UnVirex\siglsp.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\”UnVirex” = “UnVirex”