VirusHeal

VirusHeal Description

As an update to the confirmed scamware product SpyHeal, VirusHeal may have swapped its specialty from anti-spyware to anti-viruses, but VirusHeal is no more legitimate than its predecessors and can be considered to be a rogue anti-virus program with no beneficial features. SpywareRemove.com malware researchers have found that VirusHeal, like many other types of fake AV programs, is often installed by Zlob Trojans and will engage in standard scamware attacks such as creating fake error messages, inaccurate scanner displays and even hijack your desktop or web browser. Since VirusHeal uses multiple components to achieve its functions, not all of which are obviously-visible or compliant with normal deletion techniques, you should detect and delete VirusHeal with genuine anti-malware scanners if you can access them.

VirusHeal – More Harmer Than a Healer

VirusHeal was first noted as long ago as 2007, although VirusHeal still remains capable of attacking modern Windows computers, particularly with the aid of Zlob Trojans like Trojan-Downloader.Zlob.Media-Codec. Contact with Trojans that install VirusHeal is often caused by the download of fake media codecs and movie player updates that are hosted at malicious websites, two of which include virusheal.com and inc-codec.com. VirusHeal, like other types of fake anti-virus applications, will always present inaccurate and valueless information about your PC and attempt to make you be convinced that countless Trojans, rootkits, keyloggers and other PC threats are assailing your PC.

VirusHeal’s errors can include, but, as SpywareRemove.com malware researchers note, are not limited to the following examples:

Your computer is infected!
Protect Your Computer From Viruses.
You need to use antivirus software.

WARNING! YOU’RE IN DANGER!
ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK.

WHEN YOU VISIT SITES, SEND EMAILS… ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS, AND IN SOME CASES FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

These error messages are displayed without any attempt by VirusHeal to detect viruses, spyware or other threats to your PC, and its only point is to make you desperate enough to spend money on VirusHeal. Naturally, this should never be done, not even to remove VirusHeal, since VirusHeal can be removed by anti-malware applications, and its symptoms put to a halt, without requiring you to spend a dime on VirusHeal’s fake AV features.

Healing Up from VirusHeal’s Many Ailments

VirusHeal and associated PC threats (such as Zlob) may also cause some or all of the following attacks until they’re removed:

Browser redirects to malicious websites like virusheal.com. In addition to promoting VirusHeal, websites may also attack your PC with drive-by-download scripts that install PC threats without your permission. SpywareRemove.com malware experts advise that your web browser security should, therefore, be considered to be of paramount importance.
A desktop image that’s changed to display a frightening warning or other type of inaccurate message.
Issues with your anti-malware software that prevent them from removing VirusHeal. These issues can be solved by disabling VirusHeal (via Safe Mode, booting from a remote source or similar methods) prior to deleting VirusHeal.

VirusHeal can be detected by the aliases of AVGold and not-a-virus:FraudTool.Win32.MalwareWipe.q.

VirusHeal Automatic Detection Tool (Recommended)

Is your PC infected with VirusHeal? To safely & quickly detect VirusHeal, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect VirusHeal What happens if VirusHeal does not let you open SpyHunter or blocks the Internet?

Technical Details

Visual & GUI Characteristics

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	VirusHeal 4.1 Website.lnk	658
2	Uninstall VirusHeal 4.1.lnk	614
3	VirusHeal 4.2.exe	593
4	VirusHeal 4.1.exe	468
5	VirusHeal 4.2.lnk	307
6	Uninstall VirusHeal 4.2.lnk	255
7	VirusHeal 4.2 Website.lnk	241
8	VirusHeal 3.8.exe	241
9	VirusHeal 3.7.exe	96
10	VirusHeal 4.0.exe	14

More files

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}VirusHeal 3.7VirusHeal 3.7.exeVirusHeal 3.8.exeVirusHeal 3.9VirusHeal 3.9.exeVirusHeal 4.0VirusHeal 4.0.exeVirusHeal 4.1VirusHeal 4.1.exeHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}VirusHeal 3.7VirusHeal 3.9VirusHeal 4.0VirusHeal 4.2
The following CLSID's were detected:
HKEY..\..\{CLSID Path} {069ABEB8-68C3-4892-AC36-310F3B28C218}{390AB028-1823-448E-9A97-C8BF8B8389F8}{19010E07-FF82-4925-AB49-90E479FA5534}{18575018-5085-49B9-B2E6-5D5F34B4F1AC}{33744344-7FA6-45AF-8F0E-9735A0E0A5BA}{4BAEA782-9AEE-45DF-BF85-08DA17AA96D6}{99E98E9D-5765-47DB-A0BC-C25E4AACBA86}{57958A0E-7CD6-497B-989B-81954466779E}{7175F56C-A1FA-4E93-B6B5-5AB667559C56}{ACA33B7B-544B-4A1A-AFD1-F7FEA6D850D2}{DD0D439A-6AAE-478F-843F-F879D3B9149D}{CDD463FF-A3F7-4219-A720-47154C5A6321}{D80CD60B-CB5A-439A-817B-F06065D3F3C1}{3D739A75-747B-49A8-AC24-B2DBBB1596A6}{1DD68697-277C-4F62-A4B7-A3D03D5C5653}{367925E5-21B6-4745-B09D-72C0BF88EFDB}{45B5746D-ABDC-42C8-97A6-0160765DDB43}{48DCAFE5-645B-4FCC-B8FC-DF7C949BD79C}{5C19DB2A-4377-4836-B35A-70982622BD48}{583F6B65-18B1-4B82-84B0-6847ADA0B22E}{70573CA7-BF3E-432E-85C4-957FDE4D1271}{75DD2022-3F56-4D92-92BE-B81B6841D505}{A9CC4F00-9064-4C9F-9A9A-D59E2744FBC9}{CAF1FAAE-64B1-4FE7-8EE3-62B3DA241298}{C91D2160-A8A7-4FEB-81C5-E125E585F459}{C5F970ED-F7F4-43B6-8BDA-217769DAE93A}{AAAF4E25-A3C4-402C-87A3-4A1B6843E773}{EF98F1BB-D356-4480-98B3-EF0922361C36}{0F3B3E54-0E99-4152-8981-34A1EF0B8D22}{3550312B-F5C7-459A-8E9C-4040DF97EDB1}{49E0DA07-914F-49D1-9DCE-DCA092B8F3C4}{38ADFE7A-B482-4C9A-A2C0-9144C6BBC247}{5716462F-A83A-4058-A504-C4257716CD4B}{73D64722-56E7-431A-952E-5B96CA79DFC2}{778FCC36-2CE1-474F-9602-1FD5E4D501B9}{B7C16080-CCCC-4E7B-9898-B5C6B559179D}{C325F2EE-A787-475C-ABAE-9B450A88FE3E}{C4E65AF5-1CC3-4673-BC07-AA047E67F025}{E005E68C-CC8B-4A65-BFD5-F8118B0E7E90}{60B3B429-ADE8-4E3A-B824-C5784906CEFF}{10C4A25D-414E-45B7-8D78-B6679CC6E5C3}{3D28C8EB-1E06-409D-8520-E65CDD1A8559}{63A67A62-E465-42BA-9FAE-662D25D08C2C}{76EE1573-8401-4AE8-8013-C0AE81FE391C}{5F42180F-E7FD-4087-B25A-BEDAC4E982A8}{451A67A3-3EA7-4B72-8C4E-71F9BC59A44C}{6D5921D1-F80B-4F9B-857E-1F0DF9BFCB5E}{530FBDF0-EDCF-4F8F-998C-9C3F17862EAF}{93B1A68C-2BFE-4013-8856-80ABECE5798A}{DE189B09-1375-4A78-ABFD-E0E019AD52CC}