English 
Deutsch
Español
Français
Portuguese
AntiAID AntiAID
By
Domesticus in Rogue Anti-Spyware Program |
0 views
(No Ratings Yet)
Loading ...
AntiAID Description
AntiAID is a fake anti-spyware application from the same family as WiniBlueSoft. AntiAID was created with a slightly different graphical user interface than previous rogueware in its family. AntiAID generally spreads through infected video codecs or flash updates. Once AntiAID has managed to enter a system, it will conduct a fake system scan on a user’s system. The scan will display exaggerated results of virus infections, followed by frequent displays of annoying pop-ups and recommendations to purchase the full version of AntiAID. AntiAID and all its related notifications are not to be trusted.
Type: Rogue AntiSpyware Programs
How Can You Detect AntiAID?
AntiAID Technical Report
As new AntiAID details are reported by our customers and findings from our Threat Research Center, we will update this section.
The following AntiAID files with its MD5s were created in the system:
| File Name | File Size | MD5 |
|---|
| AntiAID.exe | 1634304 | b95c5544cbd3d182d23b7043e0db7c2b |
| setup[1].exe | 1733885 | cb16e317b3ebedcd394a3623dc98b3bf |
AntiAID has typically the following processes in memory:
- c:\WINDOWS\system32\29418tro5ez.ocx
- c:\Program Files\AntiAID Software\AntiAID\uninstall.exe
- AntiAID.exe
- c:\Program Files\AntiAID Software\AntiAID\AntiAID.exe
- %Temp%\8enyqcv1.exe
AntiAID created the following directories, files, paths:
- %ProgramFiles%\AntiAID Software\AntiAID
- %AllUsersProfile%\Start Menu\Programs\AntiAID
AntiAID creates the following registry entries:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiAID
- HKEY_LOCAL_MACHINE\SOFTWARE\AntiAID
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “AntiAID”
- HKEY_CURRENT_USER\Software\AntiAID
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “8enyqcv1.exe”
Important Article Disclaimer
