Faked Host Name -

This section provides some notes on how Antivirus System PRO added entries to C:\WINDOWS\system32\drivers\etc\hosts to link faked host names to its Web site at IP address of

More notes on what I did to remove Antivirus System PRO and related malicious programs.

24. Looking at file, C:\WINDOWS\system32\drivers\etc\hosts. New entries are there:

... localhost
::1 localhost surety.microsoft.com aware-protect.com www.aware-protect.com

25. Deleting all entries from C:\WINDOWS\system32\drivers\etc\hosts.

26. Looking at IP address,, on www.whois.ws. It is registered to Netelligent Hosting Services Inc. in Canada:

OrgName:    Netelligent Hosting Services Inc.
OrgID:      NHS-31
Address:    1396 Franklin Drive
City:       Laval
StateProv:  QC
PostalCode: H7W-1K6
Country:    CA

NetRange: -
NetName:    NETEL-ARIN-BLK02
NetHandle:  NET-209-44-96-0-1
Parent:     NET-209-0-0-0-0
NetType:    Direct Allocation
RegDate:    2006-08-01
Updated:    2007-03-20 

Some quick conclusions:

Table of Contents

 About This Windows Security Book

 Windows 8: System Security Review

 Windows 8: System Security Protection

 Windows 8 System Recovery

 Windows 8 Defender for Real-Time Protection

 Windows 7: System Security Review

 Windows 7: System Security Protection

 Windows 7 System Recovery

 Windows 7 Forefront Client Security

 Norton Power Eraser - Anti-Virus Scan Tool

 McAfee Virus and Malware Protection Tools

 Spybot - Spyware Blocker, Detection and Removal

 Keeping Firefox Secure

 Keeping IE (Internet Explorer) Secure

 Malware (Adware, Spyware, Trojan, Worm, and Virus)

 HijackThis - Browser Hijacker Diagnosis Tool

 IE Add-on Program Listing and Removal

 "Conduit Search" - Malware Detection and Removal

 "Tube Dimmer", "Scorpion Saver" or "Adpeak" Malware

 Malware Manual Removal Experience

 Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal

 Trojan and Malware "Puper" Description and Removal

 VSToolbar (VSAdd-in.dll) - Description and Removal

 PWS (Password Stealer) Trojan Infection Removal

 MS08-001 Vulnerability on Windows Systems

Antivirus System PRO

 Antivirus System PRO - Fake Security Alert

 Antivirus System PRO - Task Bar Icon Message

 Malicious Progarm - WinSpywareProtect sysguard.exe

 Malicious Programs - pp10.exe and ld12.exe

 IE BHO - iehelper.dll

Faked Host Name -

 Malicious System Service - drv.dll and drv.sys


 Full Version in PDF/ePUB