The Emsisoft malware research team has discoverd a new outbreak of the Wireshark Antivirus adware. Emsisoft Anti-Malware detects this malware as Adware.Win32.WiresharkAntivirus.

Wireshark Antivirus is a rogue security program, this is a new variant of SysAntivirus (alias Sysinternals Antivirus), XJR Antivirus, AKM Antivirus 2010 Pro and RTS Antivirus 2010. The maker of this rogue give it name as Sysinternals Antivirus. A rogue application tries to trick you by displaying false positive/misleading scan results report, which says that your computer is infected with viruses or trojan, but you will not be able to delete them before you purchase.

Create new files:

• %ProgramFiles%\skynet.dat
• %ProgramFiles%\svchost.exe
• %ProgramFiles%\wp3.dat
• %ProgramFiles%\wp4.dat
• %ProgramFiles%\adc_w32.dll
• %ProgramFiles%\alggui.exe
• %ProgramFiles%\nuar.old
• %ProgramFiles%\Wireshark Antivirus\Wireshark Antivirus.exe
• %UserProfile%\Desktop\Wireshark Antivirus.lnk
• %UserProfile%\Start Menu\Programs\Wireshark Antivirus\Wireshark Antivirus.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}
  (SZ) (Default) = ADC PlugIn

• HKEY_LOCAL_MACHINE\software\Classes\CLSID\{149256D5-E103-4523-BB43-2CFB066839D6}\InprocServer32
  (SZ) (Default) = C:\Program Files\adc_w32.dll
  (SZ) ThreadingModel = Apartment

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd
  (DWORD) Type = 0×00000010 (16)
  (DWORD) Start = 0×00000002 (2)
  (DWORD) ErrorControl = 0×00000001 (1)
  (SZ) DisplayName = Adobe Update Service
  (SZ) ImagePath = C:\Program Files\svchost.exe

Modify registry entry:

• HKEY_LOCAL_MACHINE\software\Classes\exefile\shell\open\command
  Old: (SZ) (Default) = “%1″ %*
  New: (SZ) (Default) = C:\Program Files\alggui.exe “%1″ %*

Screenshots:

How to remove the infection of Wireshark Antivirus (Adware.Win32.WiresharkAntivirus)?

To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.