Antispyware Pro 2012

Antispyware Pro 2012 Description

Sometimes referred to as the Theresa.URL Virus, Antispyware Pro 2012 is a variant of Trojan:Win32/WinSpywareProtect, a rogue anti-spyware program that’s distributed via e-mail spam. Antispyware Pro 2012 acquired its nickname by creating Theresa.URL-named shortcuts on the desktops of infected PCs, but SpywareRemove.com malware researchers consider Antispyware Pro 2012′s fraudulent security pop-up and system scans to be more serious than its shortcut additions. Like similar types of scamware, Antispyware Pro 2012 will claim that your PC is infected and will request a fee so that its purchasable version can remove all PC threats, but Antispyware Pro 2012 doesn’t have any true ability to search or delete spyware (or any other type of hostile software, for that matter). Antispyware Pro 2012 should be removed as soon as you can launch anti-malware software to scan your PC, particularly since Antispyware Pro 2012′s last-confirmed distribution method also uses a Trojan that may cause other attacks.

From 2008 to All the Way to Antispyware Pro 2012

Antispyware Pro 2012 can be considered a direct copy or descendant of other variants of rogue anti-spyware scanners from its family and includes their basic off-blue appearance as well as their attacks. Some examples of Antispyware Pro 2012 clones from the FakeRean that SpywareRemove.com malware researchers have unearthed include AntivirusXP 2008, Win 7/Win 8/XP Defender 2013, XP Home Security 2013, XP Security Cleaner Pro, Windows Vista Internet Security 2012, Win 7 Internet Security 2012, Win 7 Smart Defender Pro, Vista Antivirus 2008, Win 8 Security System, XP Security 2012, Win 8 Defender 2013, AntiSpy Safeguard, Internet Security Pro 2013, Win 7 Internet Security 2013, XP Internet Security Pro 2013, Vista Internet Security 2012, Vista Security 2013, XPdefender, Vista Antivirus 2013, Internet Security Plus, Win 7 Home Security 2013, Win 7 AntiVirus 2012, Vista Defender, Windows Essentials Pro 2013, XP Anti-Virus 2011, Win 7 Internet Security 2011, Vista Security Cleaner Pro, XP Total Security 2013, Win 7 Home Security Pro 2013, Win 7 Security Plus 2013, ThinkPoint, Antivirus Pro 2009, Vista Security 2012, Win 7 Internet Security Pro 2013, XP Home Security 2012, Internet Security 2012, PCclean Pro, Internet Security Premium, XP Antivirus 2013, XP Internet Security 2013, Vista Home Security 2013, Win 7 Security 2012, Win 8 Home Security 2013, PC Defender Plus, Win 7 Security Cleaner Pro, Windows 7 Internet Security 2012, Internet Security, Spyware Protection 2010, Win 8 Antivirus 2013, XP Security Plus 2013, Vista Smart Defender Pro, Windows XP Internet Security 2012, Win 8 Security Suite 2013, XP Smart Defender Pro, Win Server Defender, XP Internet Security 2012, Windows Vista Antivirus 2012, XP Antispyware 2013, Vista Antispyware 2013, Win 8 Antispyware 2013, Vista Security Plus 2013, Win 7 Antivirus 2013, Win 7/XP/Vista Protection 2013, Windows Antivirus 2008, Internet Security Pro, Antivirus2008, Internet Security 2014, Win 7 Defender, Windows 7 Antispyware 2012, Internet Security Protection, Win 7/Vista/XP Smart Defender, Internet Security 2013, Vista Antivirus 2008, CleanThis, Privacy Protection, Win 7 Security 2013, Antivirus2008Pro, Win 7 Antispyware 2013, XP Security 2013, Palladium Pro, Windows Vista Security 2012, Vista Antivirus 2012 and Internet Protector. Although each of these fake anti-spyware programs pretend to be able to protect your PC from spyware-related PC threats, the only thing Antispyware Pro 2012 and its relatives can do is launch attacks as noted below:

Adding unwanted icons to your Desktop that link to malicious and spam-oriented websites, potentially including pornographic domains.
Launching with Windows and displaying fake system scans during startup.

These scans will always return results that are dominated by various types of PC threats, and SpywareRemove.com malware researchers suggest that you ignore them as inaccurate.
Launching various pop-up alerts as a secondary method of displaying fake security-related information.

Keeping the Antispyware Pro 2012 Hoax Far Away from Your Hard Drive

As of the time of this writing, Antispyware Pro 2012 and its variants have been found to be distributed primarily via fraudulent Microsoft security e-mail messages. These messages claim that Microsoft is using e-mail to distribute links for a free security program as protection against the infamous Conficker virus. Of course, SpywareRemove.com malware researchers note that Microsoft and equally reputable companies never distribute software in this fashion. Clicking the link in this e-mail, the only software you’ll acquire is a Trojan, TrojanDownloader:Win32/Renos.HL, that installs Antispyware Pro 2012 or a relative.

Although, at this point, Antispyware Pro 2012′s family is several years old, Antispyware Pro 2012 is still in distribution as of 2012, and SpywareRemove.com malware analysts recommend that you keep good anti-malware applications on your hard drive to detect or delete Antispyware Pro 2012 whenever it’s necessary.

Antispyware Pro 2012 Automatic Detection Tool (Recommended)

Is your PC infected with Antispyware Pro 2012? To safely & quickly detect Antispyware Pro 2012, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect Antispyware Pro 2012 What happens if Antispyware Pro 2012 does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name
1	%AppData%\result.db
2	%Desktop%\Antispyware Pro 2012.lnk
3	%CommonStartMenu%\Programs\Antispyware Pro 2012.lnk

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnHTTPSToHTTPRedirect" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegedit" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = 0HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "net" = "2012-5-12_7"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Settings "UID" = "ypjcmvvgbv"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorAdmin" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "ConsentPromptBehaviorUser" = 0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "EnableLUA" = 0HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\ASProtectHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emsw.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\patch.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe