Antivirus System PRO

Windows Security Tutorials - Herong's Tutorial Examples

∟Antivirus System PRO

This chapter provides some notes on removing Antivirus System PRO infection. Topics include Antivirus System PRO fake security alert; malicious programs sysguard.exe and iehelper.dll; related backdoor trojans: pp10.exe and ld12.exe.

Antivirus System PRO - Fake Security Alert

Antivirus System PRO - Task Bar Icon Message

Malicious Progarm - WinSpywareProtect sysguard.exe

Malicious Programs - pp10.exe and ld12.exe

IE BHO - iehelper.dll

Faked Host Name - 209.44.111.62

Malicious System Service - drv.dll and drv.sys

Conclusion:

Antivirus System PRO can infect local systems through malicious Websites.
Antivirus System PRO uses fake security alerts to scare users to purchase this program.
Antivirus System PRO uses fake host names, like surety.microsoft.com, linking to IP address 209.44.111.62.
Antivirus System PRO installs two files %SYSTEMROOT%\sysguard.exe and %SYSTEMROOT%\system32\iehelper.dll.
Antivirus System PRO may be bundled with other virus programs, pp10.exe, ld12.exe, drv.dll, etc.