White Shark Virus
White Shark Virus is a clone of the fake anti-virus called Wireshark Antivirus. Once White Shark Virus is inside a system it will create a start-up registry entry and modify the browser settings. Then White Shark Virus will display fake scanners, pop-ups and security alerts to trick a user into believing that his/her system is infected. The user will be prompted to purchase the full version of White Shark Virus in order to remove all the security threats detected by the fake scan. Of course this is a scam and users should never purchase White Shark Virus but have it removed upon detection.
File System Details
White Shark Virus may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | c:\Program Files\alggui.exe | |
| 2. | c:\Program Files\Sysinternals Antivirus\Sysinternals Antivirus.exe | |
| 3. | c:\Program Files\adc_w32.dll | |
| 4. | c:\Program Files\scdata\dbsinit.exe | |
| 5. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsrr.exe | |
| 6. | C:\Program Files\Wireshark Antivirus\Wireshark Antivirus.exe | |
| 7. | c:\Program Files\svchost.exe | |
| 8. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn.exe | |
| 9. | c:\Program Files\nuar.old | |
| 10. | c:\Program Files\wp4.dat | |
| 11. | c:\Program Files\scdata\images | |
| 12. | c:\Program Files\scdata\images\i3.gif | |
| 13. | c:\Program Files\scdata\images\j3.gif | |
| 14. | c:\Program Files\scdata\images\jj3.gif | |
| 15. | c:\Program Files\scdata\images\l3.gif | |
| 16. | c:\Program Files\scdata\images\t2.gif | |
| 17. | c:\Program Files\scdata\images\up2.gif | |
| 18. | c:\Program Files\scdata\images\w2.gif | |
| 19. | c:\Program Files\scdata\images\wt1.gif | |
| 20. | c:\Program Files\Sysinternals Antivirus | |
| 21. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.lti | |
| 22. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.mt | |
| 23. | %UserProfile%\Application Data\Microsoft\Internet Explorer\wmrun.log | |
| 24. | c:\Program Files\extra2.dat | |
| 25. | c:\Program Files\wp3.dat | |
| 26. | c:\Program Files\scdata\wispex.html | |
| 27. | c:\Program Files\scdata\images\i2.gif | |
| 28. | c:\Program Files\scdata\images\j2.gif | |
| 29. | c:\Program Files\scdata\images\jj2.gif | |
| 30. | c:\Program Files\scdata\images\l2.gif | |
| 31. | c:\Program Files\scdata\images\t1.gif | |
| 32. | c:\Program Files\scdata\images\up1.gif | |
| 33. | c:\Program Files\scdata\images\w11.gif | |
| 34. | c:\Program Files\scdata\images\word.doc | |
| 35. | c:\Program Files\scdata\images\wt3.gif | |
| 36. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.ltd | |
| 37. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.aci | |
| 38. | %UserProfile%\Application Data\Microsoft\Internet Explorer\wmharun.log | |
| 39. | %UserProfile%\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk | |
| 40. | c:\Program Files\extra1.dat | |
| 41. | c:\Program Files\skynet.dat | |
| 42. | c:\Program Files\scdata | |
| 43. | c:\Program Files\scdata\images\i1.gif | |
| 44. | c:\Program Files\scdata\images\j1.gif | |
| 45. | c:\Program Files\scdata\images\jj1.gif | |
| 46. | c:\Program Files\scdata\images\l1.gif | |
| 47. | c:\Program Files\scdata\images\pix.gif | |
| 48. | c:\Program Files\scdata\images\Thumbs.db | |
| 49. | c:\Program Files\scdata\images\w1.gif | |
| 50. | c:\Program Files\scdata\images\w3.jpg | |
| 51. | c:\Program Files\scdata\images\wt2.gif | |
| 52. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151.acf | |
| 53. | %UserProfile%\Application Data\Microsoft\Internet Explorer\ccsmn151_0.acb | |
| 54. | %UserProfile%\Application Data\Microsoft\Internet Explorer\lleod150 | |
| 55. | %UserProfile%\Start Menu\Programs\Sysinternals Antivirus |
Registry Details
White Shark Virus may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ExplorerBrowser Helper Objects{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavappr"
HKEY_CLASSES_ROOT\CLSID{149256D5-E103-4523-BB43-2CFB066839D6}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "novavapp"
HKEY_CURRENT_USER\Software\Wireshark Antivirus
HKEY_LOCAL_MACHINE\SYSTEM\Current\Control\SetServices\AdbUpd
