VirusBye
VirusBye is a rogue anti-spyware application typically featured with a Korean interface. VirusBye spreads by way of trojans and malicious websites, infiltrating computers in order to flood the user with popup windows and fake security alerts, in order to trick the user into believing that the computer is compromised and the only solution is to purchase and download the commercial version of the fake spyware remover VirusBye. Fabricated system scan results also accomplish this goal.
File System Details
VirusBye may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %ProgramFiles%\virusbye\MCClean.dll | |
| 2. | %ProgramFiles%\virusbye\virusbyeRes.dll | |
| 3. | %ProgramFiles%\virusbye\MCBlock.dll | |
| 4. | %ProgramFiles%\virusbye\virusbye.exe | |
| 5. | VirusBye.exe | |
| 6. | %ProgramFiles%\virusbye\uninstall.exe | |
| 7. | %ProgramFiles%\virusbye\virusbyeUpdater.exe | |
| 8. | %ProgramFiles%\virusbye\virusbye.url | |
| 9. | %UserProfile%\Start Menu\Programs\virusbye\[KOREAN LANGUAGE CHARACTERS].Bye.lnk | |
| 10. | %ProgramFiles%\virusbye\data\Enc_Code.ss | |
| 11. | %UserProfile%\Start Menu\Programs\virusbye\[KOREAN LANGUAGE CHARACTERS].Bye [KOREAN LANGUAGE CHARACTERS].lnk | |
| 12. | VirusBye.lnk | |
| 13. | %UserProfile%\Desktop\[KOREAN LANGUAGE CHARACTERS].Bye.lnk |
Registry Details
VirusBye may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "VirusBye"
