AV Security 2012 or Gen:Variant.Kazy.47304 Removal Report

AV Security 2012 Description

Type: Rogue AntiSpyware Programs

AV Security 2012, Another Iteration of the FakeScanti Trojan

The fake security program AV Security 2012 belongs to the FakeScanti family of rogue anti-virus programs, also known as WinAVPro. AV Security 2012 pretends to be a legitimate security program but, in fact, is linked to a Trojan that is part of a well-known online scam. AV Security 2012 is not alone, there are dozens of versions of fake anti-virus applications (also known as rogue anti-spyware programs) linked to this malicious threat. Rogue anti-virus applications similar to AV Security 2012 have been known to appear since at least 2009, and probably before. AV Security 2012 is part of a batch of clones of this rogue anti-virus program that add the year "2012" to the end of their names. These clones have started to make their appearances in the fall of 2011, taking advantage of the coming new year. ESG malware analysts strongly advise against falling for the AV Security 2012 scam.

Despite its name, AV Security 2012 offers absolutely no anti-virus protection. In fact, AV Security 2012 is classified as a malware infection in itself and contains characteristics of an identified security threat. AV Security 2012 uses a variety of malicious scripts and Trojans to cause harm to the infected computer system. Known clones of AV Security 2012 include Security Guard, Sysinternals Antivirus, Wireshark Antivirus, Milestone Antivirus, BlueFlare Antivirus, WolfRam AntiVirus, OpenCloud Antivirus, OpenCloud Security, Data Restore, OpenCloud AV, Security Guard 2012, AV Guard Online, Guard Online, Cloud Protection, AV Protection Online, System Protection 2012, Sphere Security 2012, AV Protection 2011, Super AV 2013. These fake security programs also have versions with the "2011" suffix. Do not fall for this scam, AV Security 2012 is the same fake security application as its previous versions, with only slight changes made to its outer appearance.

Symptoms of AV Security 2012

An AV Security 2012 infection is very easy to spot. The criminals behind AV Security 2012 designed their rogue anti-virus program's presence to be as obvious as possible. However, many computer users may not understand that AV Security 2012 is not a real security program. Recognizing rogue anti-virus programs like AV Security 2012 for what they are, is the most important thing to remember when dealing with these kinds of malware infections. A computer system infected with AV Security 2012 will become slow and unstable and will display a constant stream of fake error messages, security alerts and fake system scans. AV Security 2012 has also been known to contain browser hijacking components, designed to take over the infected computer's Internet browser, in order to force it to visit websites associated with the AV Security 2012 threat.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection

Panda Generic Backdoor

Fortinet W32/FakeAV.IS!tr.bdr

AhnLab-V3 Backdoor/Win32.Gbot

Antiy-AVL Backdoor/Win32.Gbot.gen

eTrust-Vet Win32/Cycbot.KC!generic

AntiVir TR/Kazy.47304

DrWeb BackDoor.Gbot.1589

Comodo TrojWare.Win32.Kryptik.WPP

BitDefender Gen:Variant.Kazy.47304

Kaspersky Backdoor.Win32.Gbot.rkq

Avast Win32:Cybota [Trj]

NOD32 a variant of Win32/Kryptik.WSZ

K7AntiVirus Trojan

Fortinet W32/Kryptik.AB!tr

AhnLab-V3 Trojan/Win32.PornoAsset

Technical Information

Screenshots & Other Imagery

AV Security 2012 Video

Tip: Turn your sound ON and watch the video in Full Screen mode.

File System Details

AV Security 2012 creates the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detection Count
1	zaberg.exe	a9cd2ba73ed5b431ba8aad56e8d89844	12
Name: zaberg.exe MD5: a9cd2ba73ed5b431ba8aad56e8d89844 Size: 45.05 KB (45056 bytes) Detection Count: 12 Type: Executable File Path: %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\ Group: Malware file Last Updated: May 17, 2020
2	lvvm.exe	ebcd3086072280285592e8a5431adb5d	11
Name: lvvm.exe MD5: ebcd3086072280285592e8a5431adb5d Size: 182.27 KB (182272 bytes) Detection Count: 11 Type: Executable File Path: %PROGRAMFILES(x86)%\71346\ Group: Malware file Last Updated: November 18, 2011
3	n.	b40a6b8dc690cbd4e96bc16f6c4bee1c	5
Name: n. MD5: b40a6b8dc690cbd4e96bc16f6c4bee1c Size: 74.24 KB (74240 bytes) Detection Count: 5 Path: %SystemDrive%\RECYCLER\S-1-5-21-4168701361-1266486392-1090043892-1007\$4a52a1627ae1e67bebec74de81edea2d\ Group: Malware file Last Updated: October 5, 2012
4	FVelOBtzPyAiDoF.exe	0e54f12d5d681da60c2e66e3b7ace896	3
Name: FVelOBtzPyAiDoF.exe MD5: 0e54f12d5d681da60c2e66e3b7ace896 Size: 1.76 MB (1766912 bytes) Detection Count: 3 Type: Executable File Path: %WINDIR%\SysWOW64\ Group: Malware file Last Updated: November 21, 2011
5	s523l22mix.exe	73e80cfa71c28924e16d6e74343a359f	3
Name: s523l22mix.exe MD5: 73e80cfa71c28924e16d6e74343a359f Size: 49.15 KB (49152 bytes) Detection Count: 3 Type: Executable File Path: %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-7422\ Group: Malware file Last Updated: November 14, 2011
6	klmqm122y.exe	00843c5975394889ed410dc2a6210d54	3
Name: klmqm122y.exe MD5: 00843c5975394889ed410dc2a6210d54 Size: 49.15 KB (49152 bytes) Detection Count: 3 Type: Executable File Path: %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-0953\ Group: Malware file Last Updated: November 14, 2011
7	s523lswp98.exe	5c1f32763786d045c2fe186d940a9ec5	3
Name: s523lswp98.exe MD5: 5c1f32763786d045c2fe186d940a9ec5 Size: 49.15 KB (49152 bytes) Detection Count: 3 Type: Executable File Path: %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-8961\ Group: Malware file Last Updated: November 14, 2011
8	v4xEDEgT.exe	43bf50f46e19710de986693bd7e056eb	3
Name: v4xEDEgT.exe MD5: 43bf50f46e19710de986693bd7e056eb Size: 134.65 KB (134656 bytes) Detection Count: 3 Type: Executable File Path: %ALLUSERSPROFILE%\Application Data\ Group: Malware file Last Updated: November 14, 2011
9	ABE.exe	949ba76d0246bc8dfd7c9920f5f329e0	2
Name: ABE.exe MD5: 949ba76d0246bc8dfd7c9920f5f329e0 Size: 283.64 KB (283648 bytes) Detection Count: 2 Type: Executable File Path: %PROGRAMFILES%\LP\D258\ Group: Malware file Last Updated: November 14, 2011
10	F9EF3.exe	8adc9f1bdcfd18aafceff1dbd1707cea	2
Name: F9EF3.exe MD5: 8adc9f1bdcfd18aafceff1dbd1707cea Size: 166.91 KB (166912 bytes) Detection Count: 2 Type: Executable File Path: %APPDATA%\8697A\ Group: Malware file Last Updated: November 18, 2011
11	454.exe	658716973a482d8eab0b76df55343337	2
Name: 454.exe MD5: 658716973a482d8eab0b76df55343337 Size: 275.96 KB (275968 bytes) Detection Count: 2 Type: Executable File Path: %PROGRAMFILES%\LP\20F1\ Group: Malware file Last Updated: November 18, 2011
12	8F8.exe	f4b81820a1e28d96e8e02b805b0a159c	1
Name: 8F8.exe MD5: f4b81820a1e28d96e8e02b805b0a159c Size: 284.67 KB (284672 bytes) Detection Count: 1 Type: Executable File Path: %APPDATA%\Microsoft\8F8E\ Group: Malware file Last Updated: November 14, 2011
13	B69.exe	2d89ed3a4ce5096ea0dcaf5c9ba5bb0e	1
Name: B69.exe MD5: 2d89ed3a4ce5096ea0dcaf5c9ba5bb0e Size: 286.72 KB (286720 bytes) Detection Count: 1 Type: Executable File Path: %APPDATA%\Microsoft\DFF4\ Group: Malware file Last Updated: October 5, 2012
14	C:\Windows\system32\[RANDOM CHARACTERS].exe		N/A
Name: C:\Windows\system32\[RANDOM CHARACTERS].exe Type: Executable File Group: Malware file
15	%Temp%\svhostu.exe		N/A
Name: %Temp%\svhostu.exe Type: Executable File Group: Malware file
16	%System%\AV Security 2012v121.exe		N/A
Name: %System%\AV Security 2012v121.exe Type: Executable File Group: Malware file
17	C:\Windows\System32 AV Security 2012v121.exe		N/A
Name: C:\Windows\System32 AV Security 2012v121.exe Type: Executable File Group: Malware file
18	%AppData%\ldr.ini		N/A
Name: %AppData%\ldr.ini Group: Malware file
19	%Desktop%\AV Security 2012.lnk		N/A
Name: %Desktop%\AV Security 2012.lnk Type: Shortcut Group: Malware file
20	%AppData%\[RANDOM CHARACTERS]\AV Security 2012.ico		N/A
Name: %AppData%\[RANDOM CHARACTERS]\AV Security 2012.ico Group: Malware file
21	%StartMenu%\Programs\AV Security 2012\AV Security 2012.lnk		N/A
Name: %StartMenu%\Programs\AV Security 2012\AV Security 2012.lnk Type: Shortcut Group: Malware file
22	%AppData%\[RANDOM CHARACTERS]\		N/A
Name: %AppData%\[RANDOM CHARACTERS]\ Group: Malware file
23	%StartMenu%\Programs\AV Security 2012\		N/A
Name: %StartMenu%\Programs\AV Security 2012\ Group: Malware file

More files

Registry Details

AV Security 2012 creates the following registry entry or registry entries:

Registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:59232"

More Details on AV Security 2012

The following messages associated with AV Security 2012 were found:

Please tell Microsoft about this problem.
We have created an error report that you can send to us. We will treat this report as confidential and anonymous.

Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Click here to clean your PC immediately.

Security Warning
There are critical system files on your computer that were modified by malicious software.
It may cause permanent data loss.
Click here to remove malicious software.

Security Warning
Your computer continues to be infected with harmful viruses. In order to prevent permanent loss of your information and credit card data theft please activate your antivirus software. Click here to enable protection.

svchost.exe
svchost.exe was replaced with unauthorized program.
It has encountered a problem and needs to close.
If you were in the middle of something, the information you were working on might be lost.

Warning! Infection found
Unauthorized sending E-MAIL with subject "RE:" to was CANCELLED.

Warning! Infection found
Unwanted software (malware) or tracking cookies have been found during last scan. It is highly recommended to remove it from your computer.
Keylogger Zeus was detected and put in quarantine.
Keylogger Zeus is a very dangerous software used by criminals to steal personal data such as credit card information, access to banking accounts, passwords to social networks and e-mails.

Warning: Infection is Detected
Windows has found spyware infection on your computer!
Click here to update your Windows antivirus software

Windows Security Alert
To help protect your computer, Windows Firewall has blocked some features of this program.
Do you want to keep blocking this program?
Name: Zeus Trojan
Publisher: Unauthorized

Windows Security Center
Serious security vulnerabilities were detected on this computer. Your privacy and personal data may be unsafe. Do you want to protect your PC?

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Threat Level:	100 % (High)
Infected Computers:	296

First Seen:	November 9, 2011
Last Seen:	April 19, 2021
OS(es) Affected:	Windows

AV Security 2012

AV Security 2012 Description

AV Security 2012, Another Iteration of the FakeScanti Trojan

Symptoms of AV Security 2012

Aliases

Technical Information

Screenshots & Other Imagery

AV Security 2012 Video

File System Details

Registry Details

More Details on AV Security 2012

Site Disclaimer

Your comment is awaiting moderation.

Please verify that you are not a robot.

Leave a Reply

EnigmaSoft Threat Scorecard

Popular Malware

Popular Trojans

Popular Ransomware

Popular Issues

Popular How-Tos

Products

Malware Research

Company

Legal