Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Avgold.D


Aliases:


Avgold.D
not-virus:Hoax.Win32.Avgold.d

Hoax

W32

Summary

When run, this program copies itself as HOOKDUMP.EXE file to Windows System folder and then creates a startup key for that file in the Registry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
"Intel system tool"="%WinSysDir%\hookdump.exe"


where %WinSysDir% represents Windows System folder name. Then the program extracts and HTML file called SCREEN.HTML and puts it on Windows Desktop. As a result the desktop will look like that:



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

In addition the program creates an icon in System Tray and periodically displays a popup there:

All the claims that the program does using the webpage and a popup are false and are only aimed to make a user click on "Removal Instructions" link. The link points to the www.antivirus-gold.com website.





Description Created: Alexey Podrezov; July 14th, 2005;



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.