Home Rogue Websites Avsoftwareport.com

Avsoftwareport.com

Posted: December 14, 2010

Avsoftwareport.com is a malicious domain used to advertise and distribute the rogue called Antivirus Action. Avsoftwareport.com is typically encountered by users already infected with the supposed trial version of Antivirus Action. Antivirus Action will display fake security alerts with recommendations to purchase its "full version" to remove the detected malware. Never purchase Antivirus Action and do not trust anything Avsoftwareport.com produces.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Temp%\[random]\
    2 %Temp%\[random]\[random]agnz.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = "0"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:33921"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]agnz.exe"HKEY_CURRENT_USER\Software\[random]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random]agnz.exe"
Loading...