Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Rogue:W32/XPAntivirus.gen!I


Aliases:


Rogue:W32/XPAntivirus.gen!I
Rogue:W32/XPAntivirus.gen!I

Malware
Rogue
W32

Summary

Deceptive antivirus software that pressures users into buying or installing it (e.g., infecting a computer; displaying false or alarming warnings or scanning results). Once installed, it may not function as claimed.



Disinfection & Removal


Removal Tool

F-Secure Easy Clean is a free removal tool that finds and removes many of the threats detected by our Response Lab. The tool is available here.


Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Rogue:W32/Antiviruspro.gen!I is a Generic Detection for a family of rogue antivirus programs.


Execution

On execution, this rogueware will display a false antivirus scanner window and run a "scan" that will find non-existent malware on the system:

It will then direct user to pay for a "registered version" to clean the malware.

It will also periodically display a warning message on the system tray:


File System Changes

Creates these files:

  • %programfiles%\AntivirusXP\AntivirusXP.exe
  • %desktop%\AntivirusXP.lnk
  • %startmenuprograms%\AntivirusXP\AntivirusXP.lnk
  • %appdata%\Microsoft\Internet Explorer\Quick Launch\AntivirusXP.lnk
  • %temp%\stylrit0.tmp

Create these directories:

  • %programfiles%\AntivirusXP
  • %programfiles%\AntivirusXP\Suspicious
  • %programfiles%\AntivirusXP\Infected
  • %startmenuprograms%\AntivirusXP

Registry Modifications

Sets these values:

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Programs = C:\Documents and Settings\user\Start Menu\Programs
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Start Menu = C:\Documents and Settings\user\Start Menu
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Common Start Menu = C:\Documents and Settings\All Users\Start Menu
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders My Pictures = C:\Documents and Settings\user\My Documents\My Pictures
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders CommonPictures = C:\Documents and Settings\All Users\Documents\My Pictures
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders CommonMusic = C:\Documents and Settings\All Users\Documents\My Music
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders CommonVideo = C:\Documents and Settings\All Users\Documents\My Videos
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run AntivirusXP.exe = C:\Program Files\AntivirusXP\AntivirusXP.exe [Launchpoint: Run]

Creates these keys:

  • HKCU\Software\AntivirusXP
  • HKLM\Software\AntivirusXP






Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.