Home Malware Programs Rogue Anti-Spyware Programs WorldAntiSpy

WorldAntiSpy

Posted: September 15, 2010

WorldAntiSpy is a rogue anti-virus program that displays fake security notifications in order to trick you into purchasing their full version. WorldAntiSpy may change your desktop settings to issue fake warning messages, hijack the web browser and redirect you to unwanted web sites. WorldAntiSpy installs malicious files and automatically downloads itself onto your computer, which makes WorldAntiSpy difficult to remove.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\WorldAntiSpy.lnk C:\\Documents and Settings\\Administrator\\Desktop\\WorldAntiSpy.lnk C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\WorldAntiSpy.lnk C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\WorldAntiSpy\\Uninstall WorldAntiSpy.lnk C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\WorldAntiSpy\\WorldAntiSpy.lnk C:\\Documents and Settings\\Administrator\\Application Data\\Skinux\\WorldAntiSpy\\Profile.xml ProgramFiles%\\WorldAntiSpy\\imagehlp.dll ProgramFiles%\\WorldAntiSpy\\license.txt ProgramFiles%\\WorldAntiSpy\\Scanner\\Base\\base.dat ProgramFiles%\\WorldAntiSpy\\Skinux\\WorldAntiSpy\\Skins\\accel.xml ProgramFiles%\\WorldAntiSpy\\unicows.dll ProgramFiles%\\WorldAntiSpy\\unins000.dat ProgramFiles%\\WorldAntiSpy\\unins000.exe ProgramFiles%\\WorldAntiSpy\\WorldAntiSpy.exe ProgramFiles%\\WorldAntiSpy\\WorldAntiSpy.ico ProgramFiles%WorldAntiSpy\\BaseV.tmp ProgramFiles%WorldAntiSpy\\version.tmp

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\GeneralHKEY_LOCAL_MACHINE\SOFTWARE\WorldAntiSpy.comHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}WorldAntiSpy.com_is1
Loading...