New Rogue: Antivirus Plus

by LS Anders on December 11th, 2008 in Researcher Comments, Security Alerts.

Recently, we came across this rogue: Antivirus Plus. What makes this one different from others was that it was distributed directly as a fake video codec. They have now removed the fake alert step in between.

fake codec install

The installer will present a normal type of installation procedure. However, the rogue software will be installed directly as the file is started, no matter what the user chooses to do during the installation phase. Soon, a scan will start and a long row of false positives will be presented.


fake alert

The rogue will also redirect web pages by adding lines into the hosts file. The following two entries were found inside the hosts file:

When trying to access one of these pages, the user will be redirected to another server that will show a page like this:

Alert2 Browser Hijack

It's another reminder that you need to be very careful when installing unknown codecs.

No votes yet

Facebook Comments Box


Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now