Cotação de desconto para licenças múltiplas

Mudar de região

English Português
Banco de Dados de Ameaças Programa antivírus desonesto OpenCloud AV

OpenCloud AV

Por Domesticus em Programa antivírus desonesto
Traduzir Para:

Cartão de pontuação de ameaças

Popularity Rank: 19,446
Nível da Ameaça: 80 % (Alto)
Computadores infectados: 539
Visto pela Primeira Vez: October 3, 2011
Visto pela Última Vez: December 28, 2025
SO (s) Afetados: Windows

O OpenCloud AV é um dos muitos falsos programas de segurança que estão associados ao Trojan FakeScanti. Os aplicativos de segurança desonestos associados a esse Trojan são bastante típicos na forma com a qual eles atacam o sistema de um computador. Como a maioria dos programas de segurança desonestos, o OpenCloud AV foi projetado para exibir falsos alertas indicando uma infecção inexistente. Em seguida, o OpenCloud AV se oferece para remover essa infecção fictícia em troca de uma certa quantia em dinheiro. O OpenCloud AV tem a capacidade de alterar as configurações do seu sistema, alterar o registro do Windows e impedir que determinados programas sejam executados. Enquanto o OpenCloud AV faz isso tudo, o OpenCloud AV finge ser um legítimo aplicativo anti-malware. Os pesquisadores de segurança do ESG aconselham evitar comprar o OpenCloud AV ou qualquer um dos outros programas de segurança associados ao Trojan FakeScanti. O OpenCloud AV pode ser removido com um aplicativo anti-malware real.

Outros falsos programas de segurança associados a esse Trojan incluem Security Guard, Sysinternals Antivirus, Wireshark Antivirus, Milestone Antivirus, WolfRam AntiVirus, OpenCloud Antivirus, OpenCloud Security, AV Security 2012, Super AV 2013.

Problemas e Sintomas Associados ao OpenCloud AV

A presença do OpenCloud AV no sistema do seu computador geralmente resulta em vários sintomas muito perceptíveis. No entanto, esses sintomas indicam que o seu computador já foi infectado. O processo de instalação do OpenCloud AV e de malwares semelhantes geralmente apresenta poucos sintomas. Alguns problemas associados ao OpenCloud AV incluem o seguinte:

  • O OpenCloud AV pode mudar a imagem do seu desktop para uma grande mensagem de erro, que não pode ser removida ou alterada. Essa mensagem de erro normalmente começa com a frase: "PERIGO!!! O seu computador está INFETADO! Atenção!!!" e então continua dizendo ao usuário que os seus dados estão correndo o perigo de serem excluídos ou roubados. Essa característica é típica das versões mais recentes do Trojan FakeScanti, e algumas das versōes do OpenCloud AV podem não exibir esse comportamento.
  • O OpenCloud AV também exibe muitas mensagens de erro pop-up, tanto sob a forma de alertas de sistema quanto na forma de notificações pop-up da barra de tarefas (semelhantes às exibidas pelos programas de segurança oficiais do Windows).
  • O OpenCloud AV também bloqueia arquivos executáveis (ou seja, arquivos com a extensão .exe). O OpenCloud AV pode bloquear esses arquivos seletivamente, geralmente só permitindo o funcionamento dos seus próprios arquivos maliciosos e os arquivos essenciais do Windows. Os programas de segurança legítimos e os navegadores de Internet estão no topo da lista de aplicativos que o OpenCloud AV bloqueia.


<

Detalhes Sobre os Arquivos do Sistema

OpenCloud AV pode criar o(s) seguinte(s) arquivo(s):
Expandir todos | Recolher todos
# Nome do arquivo Detecções
1. %StartupFolder%\csrss.exe
2. %AppData%\OpenCloud AV\csrss.exe
3. %StartMenu%\OpenCloud AV
4. %AppData%\OpenCloud AV\ms.conf
5. %UserProfile%\Desktop\OpenCloud AV.lnk
6. %AppData%\OpenCloud AV\
7. %StartMenu%\OpenCloud AV\OpenCloud AV.lnk

Detalhes sobre o Registro

OpenCloud AV pode criar a seguinte entrada de registro ou entradas de registro:
HKEY..\..\..\..{RegistryKeys}
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" = 'C:\Program Files\conhost.exe "%1" %*'
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\C0AB6693AB3202B4B9D95716ED5CE4A6\SourceList

System Messages

The following system messages may be associated with OpenCloud AV:

Security Warning
Malicious programs that may steal your private information and prevent your system from working properly are detected on your computer.
Click here to clean your PC immediately.
Security Warning
There are critical system files on your computer that were modified by malicious software.
It may cause permanent data loss.
Click here to remove malicious software.
Security Warning
Your computer continues to be infected with harmful viruses. In order to prevent permanent loss of your information and credit card data theft please activate your antivirus software. Click here to enable protection.
Warning! Infection found
Unauthorized sending E-MAIL with subject "RE:" to [fake email address] was CANCELLED.
Warning! Infection found
Unwanted software (malware) or tracking cookies have been found during last scan. It is highly recommended to remove it from your computer.
Keylogger Zeus was detected and put in quarantine.
Keylogger Zeus is a very dangerous software used by criminals to steal personal data such as credit card information, access to banking accounts, passwords to social networks and e-mails.
Warning: Infection is Detected
Windows has found spyware infection on your computer!
Click here to update your Windows antivirus software
Warning: Spyware Detected
Windows has found spy programs running on your computer!
Click here to update your Windows antivirus software
Windows Security Alert
To help protect your computer, Windows Firewall has blocked some features of this program.
Do you want to keep blocking this program?
Name: Zeus Trojan
Publisher: Unauthorized
Windows Security Center
Serious security vulnerabilities were detected on this computer. Your privacy and personal data may be unsafe. Do you want to protect your PC?
svchost.exe
svchost.exe was replaced with unauthorized program.
It has encountered a problem and needs to close.
If you were in the middle of something, the information you were working on might be lost.
Please tell Microsoft about this problem.
We have created an error report that you can send to us. We will treat this report as confidential and anonymous.

Relatório de análise

Informação geral

Family Name: Trojan.Kryptik.VCKAH
Signature status: No Signature

Known Samples

MD5: bb7b695d99de17333a55b9a0fbef9224
SHA1: 304247bedaf08bee5f88841fcfc804e92a35f324
SHA256: FCCA17D97B02B54AF8F04E2955463E3895FDDC585785071FFFD331236DA19270
Tamanho do Arquivo: 2.59 MB, 2588672 bytes
MD5: a9f1eca12d36bffe99b77915d06d057c
SHA1: 6fa7d7dc845379e8b3b49f782511452a8f796f72
SHA256: 4143BA562241F3F8FE33D49E5927CF9CAFF6665D550EE1C76FFC8167AFE3B847
Tamanho do Arquivo: 1.03 MB, 1028096 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Nome Valor
Company Name Moliyo Ltd.
File Description America Pirates Online
File Version 1.38
Internal Name America Pirates Online
Legal Copyright Copyright (C) 2025
Original Filename America Pirates Online.exe
Product Name America Pirates Online
Product Version 1.0.0.0

File Traits

  • 2+ executable sections
  • HighEntropy
  • imgui
  • No Version Info
  • x86

Block Information

Total Blocks: 1,512
Potentially Malicious Blocks: 16
Whitelisted Blocks: 1,343
Unknown Blocks: 153

Visual Map

? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? 1 ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? ? 0 ? ? 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 1 1 x ? 0 0 0 0 0 0 0 0 ? ? 0 1 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
c:\programdata\total gameplay\petsalon\profile.dat Generic Write,Read Attributes
c:\users\user\downloads\errorlog.html Generic Write,Read Attributes
c:\users\user\downloads\keys.dat Generic Write,Read Attributes

Registry Modifications

Key::Value Dados API Name
HKCU\software\petsalon::scrwidth Ѐ RegNtPreCreateKey
HKCU\software\petsalon::scrheight ̀ RegNtPreCreateKey
HKCU\software\petsalon::bitdepth RegNtPreCreateKey
HKCU\software\petsalon::musicvolumn F RegNtPreCreateKey
HKCU\software\petsalon::soundvolumn d RegNtPreCreateKey
HKCU\software\petsalon::musicon  RegNtPreCreateKey
HKCU\software\petsalon::soundon  RegNtPreCreateKey
HKCU\software\petsalon::firstrun  RegNtPreCreateKey
HKCU\software\petsalon::autosaved  RegNtPreCreateKey
HKCU\software\petsalon::gamespeed 㾀 RegNtPreCreateKey
Show More
HKCU\software\petsalon::smoothimage  RegNtPreCreateKey
HKCU\software\petsalon::verbose  RegNtPreCreateKey
HKCU\software\petsalon::texturedetail RegNtPreCreateKey
HKCU\software\petsalon::worlddetail RegNtPreCreateKey
HKCU\software\petsalon::shadowdetail RegNtPreCreateKey
HKCU\software\petsalon::meshdetail RegNtPreCreateKey
HKCU\software\petsalon::language eng.lang RegNtPreCreateKey
HKCU\software\petsalon::video  RegNtPreCreateKey
HKCU\software\petsalon::editorhelp  RegNtPreCreateKey
HKLM\software\classes\abhf1003224::rc RegNtPreCreateKey
HKLM\software\classes\abhf1003224::rm < RegNtPreCreateKey
HKLM\software\classes\abhf1003224::serial (NULL) RegNtPreCreateKey
HKLM\software\classes\abhf1003224::demo  RegNtPreCreateKey

Tendendo

Mais visto

Carregando...