Avgold.D
Summary
When run, this program copies itself as HOOKDUMP.EXE file to Windows System folder and then creates a startup key for that file in the Registry:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Intel system tool"="%WinSysDir%\hookdump.exe"
where %WinSysDir% represents Windows System folder name. Then the program extracts and HTML file called SCREEN.HTML and puts it on Windows Desktop. As a result the desktop will look like that:
Removal
Automatic action
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Find out more
Knowledge Base
Find the latest advice in our Community Knowledge Base.
User Guide
See the user guide for your product on the Help Center.
Submit a sample
Submit a file or URL for further analysis.
Technical Details
In addition the program creates an icon in System Tray and periodically displays a popup there:
All the claims that the program does using the webpage and a popup are false and are only aimed to make a user click on "Removal Instructions" link. The link points to the www.antivirus-gold.com website.
Date Created: July 14, 2005
Date Last Modified: -