Home Malware Programs Rogue Anti-Spyware Programs Green AV Security Suite

Green AV Security Suite

Posted: June 23, 2010

Green AV Security Suite is a rogue anti-spyware program which spreads via Trojan infections, spam emails or by using affiliated websites. Green AV Security Suite generates fabricated pop-up alert messages and fake system scans, which report the presence of supposed infections on the user's computer. Green AV Security Suite will bombard the user with fake alert messages, suggesting the user purchase the full version of this fake software to remove the so-called threats. If Green AV Security Suite is detected in a machine, it should be terminated immediately using reliable anti-spyware software.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters].exe
    2 %Documents and Settings%\[UserName]\Local Settings\Application Data\[random characters ]\[random characters]tssd.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\AvScanHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" ="1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random characters]"HKEY_CURRENT_USER\Software\avsoftHKEY_CURRENT_USER\Software\avsuiteHKEY_LOCAL_MACHINE\SOFTWARE\avsoftHKEY_LOCAL_MACHINE\SOFTWARE\avsuiteHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random characters]"
Loading...