Vista Antivirus 2010

31 August 2009 Rogue 0 Comment

Vista Antivirus 2010 is a fake antivirus program that tries to mislead computer users by pretending as legitimate security program associated to MS Vista Operating System. Rogue programs like this have similar goal of using unfair marketing technique to sell itself and earn a profit at the expense of innocent consumer. Typically, Vista Antivirus 2010 uses tactics that can easily deceive computer users. It posted a barrage of warning alerts indicating that several threats are present on the system. Moreover, providing security scans that also produces similar security findings contributes to its misinformation campaign.

Force distribution of Vista Antivirus 2010 on to computers is feasible by exploiting software vulnerabilities. Trojans can download and execute this malicious program on your machine by utilizing those exploit as safe passage. Once it infects the system, it registers itself as part of Windows start-up that automatically loads the program after user’s log-on. By providing supplementary registry entry, malware can block execution of any installed program including antivirus software. Definitely, killing any running process that belongs to legitimate security application can prevent Vista Antivirus 2010′s removal.

Vista Antivirus 2010 requires immediate removal. This software is designed to update itself by establishing a connection between your PC and remote server. It will download more malware that makes it more hazardous.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
During Vista Antivirus 2010′s presence on the system, it will repeatedly issue fake alert messages in an attempt to mislead user. Some of this fake security warning are:

Tracking software found!
Your PC activity is being monitored. Possible spyware infection. Your data security may be compromised. Sensitive data can be stolen. Prevent damage now by completing security scan.

Vista Antivirus 2010 Firewall Alert!
Vista Antivirus 2010 has blocked a program from accessing the Internet
Internet Explorer is infected with Trojan-BNK.Win32-Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

Added Registry Entries:

HKCU\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCU\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCR\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKCR\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "%1" %*
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\av.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKCU\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCU\Software\Classes\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCR\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKCR\secfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "%1" %*
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKLM\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKLM\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1" 
Reference: HKCU (HKEY_CURRENT_USER), HKCR (HKEY_CLASSES_ROOT), HKLM (HKEY_LOCAL_MACHINE)

Associated Files and Folders:

c:\Documents and Settings\All Users\Application Data\HYujs7dtUT3
%UserProfile%\Local Settings\Application Data\av.exe
%UserProfile%\Local Settings\Application Data\ave.exe
%UserProfile%\Local Settings\Application Data\HYujs7dtUT3
%UserProfile%\Local Settings\Application Data\WRblt8464P
%UserProfile%\Local Settings\Temp\HYujs7dtUT3
%UserProfile%\Templates\HYujs7dtUT3

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid Vista Antivirus 2010, XP Security Tool 2010 and Vista Internet Security 2010 from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove Vista Antivirus 2010, XP Security Tool 2010 and Vista Internet Security 2010 with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to Vista Antivirus 2010, XP Security Tool 2010 and Vista Internet Security 2010.
10. Restart your computer.

Note: If Vista Antivirus 2010, XP Security Tool 2010 and Vista Internet Security 2010 prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.