Home Rogue Websites Livesecuritysuite.com

Livesecuritysuite.com

Posted: May 18, 2010

Livesecuritysuite.com (or Livesecuritysuite.net) is a corrupt website releated to Live Security Suite. Livesecuritysuite.net redirects the browser to a fake system scan which reports bogus infections on the PC to scare users into purchasing Live Security Suite, which is also a fake product. Do not fall for this trickery and have all threats associated removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\All Users\Desktop\Live Security Suite.lnk
    2 %Documents and Settings%\All Users\Start Menu\Programs\Live Security Suite
    3 %Documents and Settings%\All Users\Start Menu\Programs\Live Security Suite\Live Security Suite Home Page.lnk
    4 %Documents and Settings%\All Users\Start Menu\Programs\Live Security Suite\Live Security Suite.lnk
    5 %Documents and Settings%\All Users\Start Menu\Programs\Live Security Suite\Purchase Licence.lnk
    6 %Documents and Settings%\All Users\Start Menu\Programs\Live Security Suite\Purchase License.lnk
    7 %Program Files%\Live Security Suite
    8 %Program Files%\Live Security Suite\activate.ico
    9 %Program Files%\Live Security Suite\db
    10 %Program Files%\Live Security Suite\db\DBInfo.ver
    11 %Program Files%\Live Security Suite\db\ia080614.db
    12 %Program Files%\Live Security Suite\db\lists.ini
    13 %Program Files%\Live Security Suite\db\WMILib.dll
    14 %Program Files%\Live Security Suite\Explorer.ico
    15 %Program Files%\Live Security Suite\Languages
    16 %Program Files%\Live Security Suite\LiveSS.exe
    17 %Program Files%\Live Security Suite\unins000.dat
    18 %Program Files%\Live Security Suite\uninstall.ico
    19 %Program Files%\Live Security Suite\working.log
    20 %UserProfile%\Application Data\Live Security Suite
    21 %UserProfile%\Application Data\Live Security Suite\db
    22 %UserProfile%\Application Data\Live Security Suite\db\config.cfg
    23 %UserProfile%\Application Data\Live Security Suite\db\Timeout.inf
    24 %UserProfile%\Application Data\Live Security Suite\db\Urls.inf
    25 %UserProfile%\Application Data\Live Security Suite\settings.ini
    26 %UserProfile%\Application Data\Live Security Suite\uill.ini
    27 %UserProfile%\Application Data\Live Security Suite\unins000.exe
    28 %UserProfile%\Application Data\Live Security Suite\Uninstall Live Security Suite.lnk
    29 %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Live Security Suite.lnk
    30 %UserProfile%\Desktop\Live Security Suite.lnk
    31 %UserProfile%\Desktop\LiveSS.exe.txt
    32 %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
    33 %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
    34 %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
    35 %UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
    36 %UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Live Security SuiteHKEY_CURRENT_USER\Software\Microsoft\FTP "SearchDir" = "%Program Files%\Live Security Suite\"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PrS" = "http://gen-avpay.com/choose/?productid=GENAV3&uid=0&machineid=c3f92274b4b15694ae2311bd2316c727"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "uniname" = "Live Security Suite_is1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Live Security Suite"HKEY_LOCAL_MACHINE\SOFTWARE\Live Security SuiteHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AVPath" = "\\.\root\SecurityCenter:AntiVirusProduct.instanceGuid="{653E64F8-62B6-4F96-B22D-4FFC6E44130E}""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallDisableNotify" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirstRunDisabled" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "UpdatesDisableNotify" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent "URLSS[2.0.3.0]"HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Live Security Suite_is1
Loading...