Antivirus 2010 signifies a new generation of rogue security tools from the same family as Antivirus 2008 and Antivirus 2009. Like its previous versions, Antivirus 2010 is advertised through the use of advertisements on the Web pretending to be online anti-malware scanners.
These advertisements pretend to scan your computer and then advices that your computer is infected and that you should download and install Antivirus 2010 to remove these infections. These rogues are also known to be advertised and installed through Trojans that display fake security alerts in your Windows taskbar stating you are infected. Once you click on one of these alerts, it will bring you to the download page for Antivirus 2010, or even download and install it without your permission.
After Antivirus 2010 is installed on your computer, it will be automatically configured to run when you logon to Windows. This is done by adding a startup that launches the C:\Windows\System32\wingamma.exe executable. This executable will then launch the AV2010.exe and the fake Windows Security Center. Once running, it will scan your computer and list a variety of infections that cannot be removed unless you first purchase the software. This infection will also randomly display fake security alerts on your computer stating that you are infected or have some sort of security risk. If you click on these alerts, it will prompt you to purchase the software. These fake alerts, along with a fake Windows Security Center that advertises Antivirus 2010, are used to further scare you into thinking you are infected so you purchase the software.
Another new addition to these types of rogues is the creation of a fake Blue Screen of Death. At random intervals, Antivirus 2010 will create what appears to be a Windows crash, but in reality is just a fake screen. These fake crashes are used to further persuade you into purchasing the software. If you receive this crash, you can simply reboot your computer , or try pressing Alt-Tab or Control-Alt-Delete to get out of it. The text of the crash is:
***STOP: 0x000000D1 (0x0000000, 0xF73120AE, 0xC0000008, 0xC000000)
A spyware application has been detected and Windows has been shut down to prevent damage to your computer
SPYWARE.MONSTER.FX_WILD_0x0000000
If this is the first time you've seen this Stop error screen, restart you [sic] computer. If this screen appears again, follow these steps:
Click to make sure your antivirus software is properly installed. If this is a new installation, ask you [sic] software manufacturer for any antivirus updates you might need.
Windows detected unregistered version of Antivirus 2010 protection on your computer. If problem continue, please activate your antivirus software to prevent computer damage and data loss.
*** SRV.sys - Address F73120AE base at C0000000, DateStamp 36b072a3
If your computer displays this message, do not trust it and do not pay for Antivirus 2010 malware.
Antivirus 2010 is not a security tool; it is dangerous computer parasite. Avoid downloading or buying this program.
If you have already installed it in your computer, here’s how to remove it.
Antivirus 2010 manual removal:
Kill processes:
AV2010.exe svchost.exe wingamma.exe
Delete registry values:
HKEY_CURRENT_USER\Software\AV2010
HKEY_CLASSES_ROOT\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}
HKEY_CLASSES_ROOT\AppID\IEDefender.DLL
HKEY_CLASSES_ROOT\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO
HKEY_CLASSES_ROOT\IEDefender.IEDefenderBHO.1
HKEY_CLASSES_ROOT\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}
HKEY_CLASSES_ROOT\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0013
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0014
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Gamma Display"
Unregister DLLs:
IEDefender.dll
Delete files:
Program Files\\AV2010\\AV2010.exe Program Files\\AV2010\\svchost.exe WINDOWS\\system32\\IEDefender.dll WINDOWS\\system32\\wingamma.exe
Delete directories:
c:\Program Files\AV2010
c:\Documents and Settings\All Users\Start Menu\Programs\AV2010
Or you can use software programs to automatically remove it from your system.
• Malwarebytes Anti Malware
• Windows Defender
