Virus Doctor

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 39
First Seen: July 24, 2009
Last Seen: January 24, 2023
OS(es) Affected: Windows

Virus Doctor Image

Virus Doctor is a fake anti-virus application that is a textbook example of how rogue anti-virus programs attacks are able to steal money from their victims. Virus Doctor is linked to the website, where victims are instructed to enter their credit card information in exchange for a 'full version' of this useless application. Virus Doctor, first seen in 2009, is one of the first members of a very large family of rogue anti-virus programs. In fact, new members of the Virus Doctor family, the FakeVimes family of rogue anti-virus programs are detected every day. Fortunately, Virus Doctor's age and reputation make it reasonably easy to deal with since most legitimate security programs will have a detailed account of how the Virus Doctor infection works and how to remove it.

Some of the many known clones of Virus Doctor include older fake security programs like Virus Melt, Presto TuneUp, Fast Antivirus 2009, Extra Antivirus, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, PC Live Guard, Live PC Care, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus, Smart Security, Windows Protection Suite, Windows Work Catalyst.

If You Want Your PC to Stay Healthy, Definitely Avoid a Check-Up with Virus Doctor

Like most rogue anti-virus programs, Virus Doctor claims that Virus Doctor can carry out all kinds of advanced security tasks, such as monitoring your firewall, downloads and system security. These are all lies – ESG security analysts have found that Virus Doctor has no way to remove or detect malware. This fake security product has been programmed to do nothing but display multiple misleading error messages until victims are scared enough to believe that they need to purchase Virus Doctor to fix the imaginary threats on their computer. Virus Doctor has been known to be associated with Google redirects in order to lead computer users to malicious websites promoting Virus Doctor and its many clones. Components of Virus Doctor have also been found to shut down legitimate security programs and Windows components that are usually needed to deal with malware (such as the Windows Registry Editor and Task Manager). Sometimes, depending on the case, it may be compulsory to start up Windows in Safe Mode or from a removable drive in order to ensure that Virus Doctor cannot start up automatically and interfere with programs used for its removal.


15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
Sunbelt VirusDoctor
Panda Adware/VirusDoctor
NOD32 Win32/Adware.VirusDoctor
McAfee-GW-Edition Riskware.Fake.VDoctor.1
McAfee+Artemis potentially unwanted program Generic!Artemis
Kaspersky not-a-virus:FraudTool.Win32.VirusDoctor.a
K7AntiVirus Non-Virus:
Ikarus not-a-virus:FraudTool.Win32.VirusDoctor
Fortinet Misc/VirusDoctor
F-Secure FraudTool.Win32.VirusDoctor.a
eSafe Suspicious File
Comodo ApplicUnwnt.Win32.FraudTool.VirusDoctor.~A
CAT-QuickHeal FraudTool.VirusDoctor.a (Not a Virus)
BitDefender Spyware.3622
AVG Fake_AntiSpyware.BHK

SpyHunter Detects & Remove Virus Doctor

File System Details

Virus Doctor may create the following file(s):
# File Name MD5 Detections
1. VDocd201.exe 635ab761d6e8a486a7cc431271013222 0
2. VDoctor.exe b4aee27229aced06f4aebca7f1c2ca32 0
3. VDoctor.exe d4f8184b0a576e8fae8380b82bc5b129 0
4. VDoctor.exe ec62a31eecb1c0bcc9ff3fe54c60f652 0
5. VirusDoctor[1].exe 92f0b996b7a93751448856931b8d7e68 0

Registry Details

Virus Doctor may create the following registry entry or registry entries:
File name without path
Virus Doctor.lnk


Virus Doctor may create the following directory or directories:

%AppData%\Virus Doctor


The following cookies were found:


Related Posts


Most Viewed