AV Security 2012

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 298
First Seen: November 9, 2011
Last Seen: August 17, 2022
OS(es) Affected: Windows

AV Security 2012 Image

AV Security 2012, Another Iteration of the FakeScanti Trojan

The fake security program AV Security 2012 belongs to the FakeScanti family of rogue anti-virus programs, also known as WinAVPro. AV Security 2012 pretends to be a legitimate security program but, in fact, is linked to a Trojan that is part of a well-known online scam. AV Security 2012 is not alone, there are dozens of versions of fake anti-virus applications (also known as rogue anti-spyware programs) linked to this malicious threat. Rogue anti-virus applications similar to AV Security 2012 have been known to appear since at least 2009, and probably before. AV Security 2012 is part of a batch of clones of this rogue anti-virus program that add the year "2012" to the end of their names. These clones have started to make their appearances in the fall of 2011, taking advantage of the coming new year. ESG malware analysts strongly advise against falling for the AV Security 2012 scam.

Despite its name, AV Security 2012 offers absolutely no anti-virus protection. In fact, AV Security 2012 is classified as a malware infection in itself and contains characteristics of an identified security threat. AV Security 2012 uses a variety of malicious scripts and Trojans to cause harm to the infected computer system. Known clones of AV Security 2012 include Security Guard, Sysinternals Antivirus, Wireshark Antivirus, Milestone Antivirus, BlueFlare Antivirus, WolfRam AntiVirus, OpenCloud Antivirus, OpenCloud Security, Data Restore, OpenCloud AV, Security Guard 2012, AV Guard Online, Guard Online, Cloud Protection, AV Protection Online, System Protection 2012, Sphere Security 2012, AV Protection 2011, Super AV 2013. These fake security programs also have versions with the "2011" suffix. Do not fall for this scam, AV Security 2012 is the same fake security application as its previous versions, with only slight changes made to its outer appearance.

Symptoms of AV Security 2012

An AV Security 2012 infection is very easy to spot. The criminals behind AV Security 2012 designed their rogue anti-virus program's presence to be as obvious as possible. However, many computer users may not understand that AV Security 2012 is not a real security program. Recognizing rogue anti-virus programs like AV Security 2012 for what they are, is the most important thing to remember when dealing with these kinds of malware infections. A computer system infected with AV Security 2012 will become slow and unstable and will display a constant stream of fake error messages, security alerts and fake system scans. AV Security 2012 has also been known to contain browser hijacking components, designed to take over the infected computer's Internet browser, in order to force it to visit websites associated with the AV Security 2012 threat.ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
Panda Generic Backdoor
Fortinet W32/FakeAV.IS!tr.bdr
AhnLab-V3 Backdoor/Win32.Gbot
Antiy-AVL Backdoor/Win32.Gbot.gen
eTrust-Vet Win32/Cycbot.KC!generic
AntiVir TR/Kazy.47304
DrWeb BackDoor.Gbot.1589
Comodo TrojWare.Win32.Kryptik.WPP
BitDefender Gen:Variant.Kazy.47304
Kaspersky Backdoor.Win32.Gbot.rkq
Avast Win32:Cybota [Trj]
NOD32 a variant of Win32/Kryptik.WSZ
K7AntiVirus Trojan
Fortinet W32/Kryptik.AB!tr
AhnLab-V3 Trojan/Win32.PornoAsset

SpyHunter Detects & Remove AV Security 2012

AV Security 2012 Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

AV Security 2012 may create the following file(s):
# File Name MD5 Detections
1. AV Security 2012v121.exe e973b9f221b8155e4842cb2104b5e873 85
2. AV Security 2012v121.exe 76bfbba313bc0f324d85f8d37826f706 17
3. AV Security 2012v121.exe 2120e16552f2817c4c6267edaa3df1ab 15
4. AV Security 2012v121.exe 9c94f759d10328fda4f0cc564464bd2e 13
5. AV Security 2012v121.exe 089204eee8ae33f0301b90c43c55aef4 12
6. AV Security 2012v121.exe 9091485226bd249020d85f63d12e3860 12
7. zaberg.exe a9cd2ba73ed5b431ba8aad56e8d89844 12
8. AV Security 2012v121.exe 88707a7b3090971a9dad69c2afa161ae 11
9. lvvm.exe ebcd3086072280285592e8a5431adb5d 11
10. lvvm.exe 4be7306c6be0653a58711b269c8c05b8 11
11. AV Security 2012v121.exe f3fc11bff0fd9e735edc865fe66b8baf 10
12. AV Security 2012v121.exe 8237ef70c91437a02bd62cd48f884085 10
13. n. b40a6b8dc690cbd4e96bc16f6c4bee1c 5
14. FVelOBtzPyAiDoF.exe 0e54f12d5d681da60c2e66e3b7ace896 3
15. s523l22mix.exe 73e80cfa71c28924e16d6e74343a359f 3
16. klmqm122y.exe 00843c5975394889ed410dc2a6210d54 3
17. s523lswp98.exe 5c1f32763786d045c2fe186d940a9ec5 3
18. v4xEDEgT.exe 43bf50f46e19710de986693bd7e056eb 3
19. ABE.exe 949ba76d0246bc8dfd7c9920f5f329e0 2
20. AV Security 2012v121.exe 9d0953de50a87f4c967e5b09bc5ceb3f 2
21. F9EF3.exe 8adc9f1bdcfd18aafceff1dbd1707cea 2
22. 454.exe 658716973a482d8eab0b76df55343337 2
23. 8F8.exe f4b81820a1e28d96e8e02b805b0a159c 1
24. B69.exe 2d89ed3a4ce5096ea0dcaf5c9ba5bb0e 1
25. C:\Windows\system32\[RANDOM CHARACTERS].exe
26. %Temp%\svhostu.exe
27. %System%\AV Security 2012v121.exe
28. C:\Windows\System32 AV Security 2012v121.exe
29. %AppData%\ldr.ini
30. %Desktop%\AV Security 2012.lnk
31. %AppData%\[RANDOM CHARACTERS]\AV Security 2012.ico
32. %StartMenu%\Programs\AV Security 2012\AV Security 2012.lnk
33. %AppData%\[RANDOM CHARACTERS]\
34. %StartMenu%\Programs\AV Security 2012\

Registry Details

AV Security 2012 may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:59232"

Messages

The following messages associated with AV Security 2012 were found:

Please tell Microsoft about this problem.
We have created an error report that you can send to us. We will treat this report as confidential and anonymous.
Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Click here to clean your PC immediately.
Security Warning
There are critical system files on your computer that were modified by malicious software.
It may cause permanent data loss.
Click here to remove malicious software.
Security Warning
Your computer continues to be infected with harmful viruses. In order to prevent permanent loss of your information and credit card data theft please activate your antivirus software. Click here to enable protection.
Warning! Infection found
Unauthorized sending E-MAIL with subject "RE:" to was CANCELLED.
Warning! Infection found
Unwanted software (malware) or tracking cookies have been found during last scan. It is highly recommended to remove it from your computer.
Keylogger Zeus was detected and put in quarantine.
Keylogger Zeus is a very dangerous software used by criminals to steal personal data such as credit card information, access to banking accounts, passwords to social networks and e-mails.
Warning: Infection is Detected
Windows has found spyware infection on your computer!
Click here to update your Windows antivirus software
Windows Security Alert
To help protect your computer, Windows Firewall has blocked some features of this program.
Do you want to keep blocking this program?
Name: Zeus Trojan
Publisher: Unauthorized
Windows Security Center
Serious security vulnerabilities were detected on this computer. Your privacy and personal data may be unsafe. Do you want to protect your PC?
svchost.exe
svchost.exe was replaced with unauthorized program.
It has encountered a problem and needs to close.
If you were in the middle of something, the information you were working on might be lost.

Trending

Most Viewed

Loading...