Thursday, March 18, 2010

internet security 2010

Type: rogue

Alias: adware.win32.internet security 2010, internetsecurity2010

Description: Internet Security 2010 is a rogue anti-spyware. It may give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats. Internet Security 2010 is also known as InternetSecurity2010.

Malware Threat

Directories

C:\Documents and Settings\user-account-name\Start Menu\InternetSecurity2010
C:\Program Files\InternetSecurity2010

Files

C:\Documents and Settings\user-account-name\Start Menu\Internet Security 2010.lnk
%quicklaunchdir%\Internet Security 2010.lnk
C:\Documents and Settings\user-account-name\Desktop\Internet Security 2010.lnk
C:\Program Files\InternetSecurity2010\IS2010.exe
install.exe (md5:82e23ffea56185f78cf92b...)
setupis2010.exe (md5:14f93b5c20a1bd0ea976d2...)
setupis2010.exe (md5:2312856ad57fdfa031632a...)
C:\Documents and Settings\user-account-name\Start Menu\InternetSecurity2010\Internet Security 2010.lnk

Registry Keys

HKEY_CURRENT_USER\SOFTWARE\IS2010
HKEY_LOCAL_MACHINE\SOFTWARE\IS2010

Registry Values

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security 2010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security 2010

- agent.poAgent.PO is a trojan that allows hackers to gain access and full control over the infected computers.
- agent.poyAgent.POY is a trojan that allows hackers to access and gives full control over infected computer.
- agent.ppbAgent.PPB is a worm arrives on a system as a file dropped by other malware, it drops copies of itself as RAVMON.EXE AND AUTORUN.INF in the root drive and in all other system drives. By right clicking on these drives it shows chinese text,autoplay option and open drives in separate window.
- agent.qaAgent.QA is a trojan that allows hackers to access and gives full control over infected computer.
- agent.qdAgent.QD is an information stealing trojan that logs keystrokes pressed on infected machine.
- agent.qdcAgent.QDC is a trojan that allows hackers to access and gives full control over infected computer.
- agent.qloAgent.QLO is a trojan that downloads and executes unwanted files from web on infected machine.

internet security 2010

ACROSS THE GLOBE

ACROSS THE GLOBE

IN United States

FROM United States