Virus Melt Description

Virus Melt, a clone of Virus Doctor, is a rogue anti-spyware program with the look and feel of Virus Doctor, another rogue anti-spyware program that follows the same patterns as Antivirus 2009, Antivirus 360, Power Antivirus 2009, and Vista Antivirus 2009. Virus Melt perfoms scare tactics to influence and trick the user into buying the full commercial version of the program. One of these scare tactics is to inundate the user’s computer with fake system notifications or security alerts claiming that the PC is infected with an excessive amount of malware. Virus Melt will state that in order to remove the supposed malware threats the user must purchase the commercial version.

Virus Melt has more of an edge than previous rogue anti-spyware programs circulating the Web because it installs bogus malware files on the user’s computer. The bogus malware files are meant to appear as legitimate malware files, so when Virus Melt scans the user’s computers its scan results will report it has detected malware. The fake malware files do not pose a threat but the presence of Virus Melt on a user’s computer does. If your computer displays pop ups that mentions Virus Melt or your default homepage suddenly changes to Virus Melt’s homepage, please avoid clicking on the pop ups or links provided by Virus Melt and follow the necessary steps to remove Virus Melt.

Type: Rogue AntiSpyware Programs

Automatic Detection of Virus Melt

Virus Melt Technical Report

As new Virus Melt details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Virus Melt files with its MD5s were created in the system:

Virus Melt has typically the following processes in memory:

• %WINDOWS%\$NtServicePackUninstall$\SICKBOY.exe
• %WINDOWS%\pchealth\helpctr\System\Remote Assistance\Common\gid.dll
• %WINDOWS%\inf\sld.sys
• VMelt.exe
• %PROGRAMDATA%\05369bb\vmelt.exe
• %WINDOWS%\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\ANTIGEN.sys
• %WINDOWS%\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\exec.dll
• %WINDOWS%\ie7\delfile.sys
• %WINDOWS%\system32\mui\0009\snl2w.sys
• ReleaseXP[1].exe
• %Documents and Settings%\All Users\Application Data\7c69f0c\VMelt.exe
• %WINDOWS%\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\SM.exe
• %WINDOWS%\ie7\sld.exe
• %WINDOWS%\system32\mui\0401\PE.sys
• Virus_Melt[1].exe

Virus Melt created the following directories, files, paths:

• %AppData%\Virus Melt

Virus Melt creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Virus Melt”
• HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
• VMelt.DocHostUIHandler
• HKEY_CLASSES_ROOT\VMelt.DocHostUIHandler
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “URVMLT[]“

Important Article Disclaimer