AntiVermins

From Wikipedia, the free encyclopedia

This article may require cleanup to meet Wikipedia's quality standards.
Please improve this article if you can. (May 2008)

1 Information
2 Recovery & Files/Registry Created
3 Malware Characteristics and behavior
4 Removal
5 Related Malware
6 See also
7 Notes & References

[edit] Information

AntiVermins is a spyware program that claims to be a commercial spyware-removal utility, when in fact it is, itself, adware-advertised. The software installs itself, without consent, in the user's computer and registry. It then sends messages such as "system error, buy this software to fix" or "your system is infected with spyware, buy AntiVermins to clean it", redirecting the user to antivermins' homepage where he or she is prompted to buy the AntiVermins software for about $50. As for the homepage itself, the English version seems like a professional page, but the versions of the page in other languages appear to have been translated by poor-quality translation software.

[edit] Recovery & Files/Registry Created

It's newest version; Related with registry values below

HKEY_CLASSES_ROOT\clsid\{663de629-4ffd-a944-6f0a-64f98e925b62} HKEY_CLASSES_ROOT\interface\{eac1accd-7790-4991-a9d2-550806d6d9c3} HKEY_CLASSES_ROOT\interface\{ef2aa606-b72e-4a1b-b076-8b148661f3b7} HKEY_LOCAL_MACHINE\software\antivermins HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\antivermins.exe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antivermins HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\antivermins

relates with files named :antivermins.exe, msvcr71.dll, msvcp71.dll, antivermins.url

The creators of this program constantly change the registry values and file names (so these may subject to reediting)

you may use regedit (start\run and enter regedit in windows Xp or prior windows versions and in Windows Vista: start and then enter regedit) or use "hijack this" a small free utility to remove the above registry keys manually and delete the above files to get rid of this rogue software easily.