Emsisoft New Malware Blog » Antispyware Shield Pro http://www.anti-malware-blog.com Just another WordPress weblog Wed, 25 Jan 2012 06:47:18 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Antispyware Shield Pro Adware Removal Instructions http://www.anti-malware-blog.com/2009/12/28/antispyware-shield-pro-adware-removal-instructions/ http://www.anti-malware-blog.com/2009/12/28/antispyware-shield-pro-adware-removal-instructions/#comments Mon, 28 Dec 2009 19:39:29 +0000 emsi http://www.anti-malware-blog.com/?p=254 The Emsi Software malware research team has discoverd a new outbreak of the Antispyware Shield Pro adware. a-squared Anti-Malware detects this malware as Adware.Win32.AntispywareShieldPro.

Antispyware Shield Pro is a rogue scanner program. Once installed, this application will be immediately perform scan action without prior notice. This fake scanner application tries to trick you by displaying misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you buy this fraud application. Be careful with this program, because it not going to protect your computer but will only spend your money.

When installing, it try to make HTTP GET to the following url:

  • hxxp://scanner.entiresafescripts.net/installation/

The entiresafescripts.net itself will look like this:

Then you will be redirected to the fake scanner:

When running the application, you can see “Official web site” button on the top of the form, and if you click this button, it take you to hxxp://systemcleanerspro.net, and this site will offer you another rogue application, called “SystemCleanerPro“, a-squared Anti-Malware know this as Adware.Win32.SystemCleanerPro.

Create new files and directories:

  • %ProgramFiles%\Antispyware Shield Pro\License.rtf
  • %ProgramFiles%\Antispyware Shield Pro\uninst.exe
  • %ProgramFiles%\Antispyware Shield Pro\antispyshield.exe
  • %UserProfile%\Desktop\Antispyware Shield Pro.lnk
  • %UserProfile%\Start Menu\Programs\Antispyware Shield Pro\Antispyware Shield Pro.lnk
  • %UserProfile%\Start Menu\Programs\Antispyware Shield Pro\Uninstall.lnk

Create new registry entries:

  • HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\App Paths\antispyshield.exe
  • HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\Antispyware Shield Pro
  • HKEY_CURRENT_USER\software\Entire Safe Scripts Ltd
  • HKEY_CURRENT_USER\software\Entire Safe Scripts Ltd\Antispyware Shield Pro

Screenshots:

How to remove the infection of Antispyware Shield Pro (Adware.Win32.AntispywareShieldPro)?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

]]> http://www.anti-malware-blog.com/2009/12/28/antispyware-shield-pro-adware-removal-instructions/feed/ 0