Anilrgowda

Threat Profile: Adware-AntiVerm

Risk Assessment - Home Users: N/A - Corporate Users: N/A Date Discovered: 12/21/2006 Date Added: 12/21/2006 Origin: N/A Length: N/A Type: Program SubType: Adware DAT Required: 4924 Program Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.
See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.
See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.
Distribution
This is not a virus or a trojan. It is detected as a "potentially unwanted program". This is an anti-spyware application claiming to remove unwanted malicious spyware programs in an attempt to get you to purchase the full version of the product. In order to clean or delete any files labeled as “malicious spyware”, you must first enter a valid serial number to activate the full version or click on the “Buy Online” button and purchase the full version.
This is simply a rebranded version of Adware-Spyaxe
Privacy
A privacy policy is not displayed during installation. However, a policy can be accessed on the author's website: AntiVermins - Privacy
System Changes
General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files
"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.
Files Added
* Installer: av_setup.exe (3.08 MB)
* %ProgramFiles%\AntiVermins\uninst.exe (40.4 KB)
* %ProgramFiles%\AntiVermins\AntiVermins.url (1 KB)
* %ProgramFiles%\AntiVermins\AntiVermins.exe (1.69 MB)
* %ProgramFiles%\AntiVermins\av.dat (1.32 MB)
* %ProgramFiles%\AntiVermins\blacklist.txt (50 KB)
* %ProgramFiles%\AntiVermins\msvcr71.dll* (340 KB)
* %ProgramFiles%\AntiVermins\msvcp71.dll* (488 KB)
* %ProgramFiles%\AntiVermins\Lang\English.ini (size may vary)
* %ProgramFiles%\AntiVermins\Quarantine\
* %ProgramFiles%\AntiVermins\Logs\
* c:\Documents and Settings\(user name)\Start Menu\AntiVermins 2.1.lnk (1 KB)
* c:\Documents and Settings\(user name)\Start Menu\Programs\AntiVermins\Uninstall AntiVermins 2.1.lnk (1 KB)
* c:\Documents and Settings\(user name)\Start Menu\Programs\AntiVermins\AntiVermins 2.1.lnk (1 KB)
* c:\Documents and Settings\(user name)\Start Menu\Programs\AntiVermins\AntiVermins 2.1 Website.lnk (1 KB)
* c:\Documents and Settings\(user name)\Desktop\AntiVermins.lnk (1 KB)
* c:\Documents and Settings\(user name)\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermins 2.1.lnk (1 KB)
Registry
The following registry keys are created:
* HKEY_LOCAL_MACHINE\SOFTWARE\AntiVermins
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
"AntiVermins"="C:\Program Files\AntiVermins\AntiVermins.exe /h"
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
Uninstall\AntiVermins
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion
\App Paths\AntiVermins.exe
"default"="C:\Program Files\AntiVermins\AntiVermins.exe"
* HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
* HKEY_CLASSES_ROOT\TypeLib\{6B112EBD-0C90-4AC4-A969-F36797F00006}
* HKEY_CLASSES_ROOT\Interface\{0A1949AB-8B12-4A6F-9B5D-12D4115CCCEA}
* HKEY_CLASSES_ROOT\Interface\{1724E437-1FCE-4D21-95E2-6E2452C25628}
* HKEY_CLASSES_ROOT\Interface\{1ECABCEE-5F00-449B-BBE3-9C35E160E832}
* HKEY_CLASSES_ROOT\Interface\{2D652EC7-AF61-487A-B82A-0C4A6A9FF3C8}
* HKEY_CLASSES_ROOT\Interface\{500B879D-86C3-4C45-943F-3FC3BF793B38}
* HKEY_CLASSES_ROOT\Interface\{50FE5318-DC2A-440A-AC94-B9041819EE48}
* HKEY_CLASSES_ROOT\Interface\{59DAA331-B3F9-408E-81DF-ADE79D129600}
* HKEY_CLASSES_ROOT\Interface\{5B768BE7-942B-4838-89BF-40AB729A62AB}
* HKEY_CLASSES_ROOT\Interface\{5C0B132E-86CB-4B3B-9CAF-CB7F57A60C81}
* HKEY_CLASSES_ROOT\Interface\{78E2412E-3C9A-4EE8-AD97-3ABD95EC49D3}
* HKEY_CLASSES_ROOT\Interface\{85524659-53E5-40AF-835B-2F0B8745DF0B}
* HKEY_CLASSES_ROOT\Interface\{9A9D1422-D311-4673-8579-61FCDB76BD0D}
* HKEY_CLASSES_ROOT\Interface\{B6CDDF17-9F1A-47CA-8E3D-FF6BD1B05D3F}
* HKEY_CLASSES_ROOT\Interface\{D6BD48FC-DD6F-4242-90B0-6CBE4AD43362}
* HKEY_CLASSES_ROOT\Interface\{D7D22218-EBF0-454C-B948-11BB8FC3118B}
* HKEY_CLASSES_ROOT\Interface\{ECA8F1E3-C03F-47E6-842D-7B2BCF0445CA}
* HKEY_CLASSES_ROOT\CLSID\{663DE629-4FFD-A944-6F0A-64F98E925B62}
Network Impact
Possible increase in overhead bandwidth due to download of additional components or updates.

Removal Instructions

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs