AntiSpyware Pro: The latest Installment In A Long Line Of Parasitic Rogues
Title: AntiSpyware Pro
Also Known as: Rogue Antispyware
Severity scale:
When it comes to new and creative rogue antispyware, AntiSpyware Pro does not even come close. This parasitic infection uses all the same tactics that every rogue before it has used. Needless to say, if you happen to have any popups telling you that you need to pay for a full version of this junk, you have been infected. Most likely the infection started with a trojan, which can make it hard to get rid of manually.
AKA:
Antispy ware pro
Antispy warepro
Anti spy ware pro
Anti spyware pro
AntiSpyWarePro
FraudTool.Win32.AntiSpyWarePro
Antispywarepro.com
AntiSpyware Pro file contents:
antispyware-2008.lnk
setup.exe
ntdll64.dll
antispyware-2008.exe
setup_100527_3_.exe
antispywareproxp.exe
as2008xp.exe
[YYYYMMDDTIME].log
setup_1_2_[1].exe
Install_1_2_[1].exe
Running Processes:
antispywareproxp.exe asproxp.exe setup_1_2_[1].exe Install_1_2_[1].exe as2008xp.exe setup.exe antispyware-2008.exe setup_100527_3_.exe
Registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\Software Licensors\Antispyware PRO XPHKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\Software Licensors\Antispyware PRO XP
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\Software Licensors\Antispyware PRO XP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\asproxp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\asproxp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\asproxp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\asproxp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\asproxp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\asproxp.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\asproxp.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\asproxp.exe
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\asproxp.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\asproxp.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\asproxp.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\asproxp.exe
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\asproxp.exe
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\asproxp.exe
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\asproxp.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\Antispyware PRO XP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\Antispyware PRO XP
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\Antispyware PRO XP
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\Antispyware PRO XP
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\Antispyware PRO XP
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\Antispyware PRO XP
Registered DLLs:
services.dll
Associated Files:
%profile%\\application data\\secure solutions\\AntispywareProXP\\as2008xp.exe antispywareproxp.exe setup_100527_3_.exe %profile%\\application data\\secure solutions\\AntispywareProXP\\as2008xp.exe setup_100527_3_.exe antispyware-2008.exe ntdll64.dll setup.exe C:\\Documents and Settings\\All Users\\Application Data\\Software Licensors\\Antispyware PRO XP\\LOG\\[YYYYMMDDTIME].log setup_1_2_[1].exe Install_1_2_[1].exe
Recommended Action: Immediate Removal
Trying to remove any type of rogue application manually can be more trouble than most people have time for. To remove it without any hassles it is best to use a reliable malware removal and protection program like Spyzooka. Spyzooka is the only application in the industry that offers a 100% guarantee to remove AntiSpyware Pro as well as all other rogue applications. Do not fight this battle on your own, try Spyzooka and see how important a 100% guarantee can be for your Internet safety.
