Fake Antivirus Product Keys Site

Discuss Malware removal, techniques, trends, etc. and repairing Windows after removal.
Forum rules
1. Try to give more than you take, when possible.
2. Don't be a prick.

Fake Antivirus Product Keys Site

Postby GEGeek » Sun Jun 16, 2013 7:33 am

Just passing this along - found a site "S!Ri.URZ" that provides some product keys to those fake antivirus programs.
Deactivates it long enough to thoroughly clean the machine. Could come in handy....
http://siri-urz.blogspot.fr/
Mike
GEGeek - I don't reinvent the wheel, I just link to it.
Image
http://www.gegeek.com
GEGeek
 
Posts: 158
Joined: Wed Feb 13, 2013 8:20 am
Location: NJ

Re: Fake Antivirus Product Keys Site

Postby Xander » Sun Jun 16, 2013 1:08 pm

Saw you post that elsewhere. He's only posted 4 in the last 6 months and they're all "AA39754E-715219CE".
User avatar
Xander
 
Posts: 662
Joined: Fri Feb 08, 2013 6:08 pm
Location: Near Niagara Falls

Re: Fake Antivirus Product Keys Site

Postby GEGeek » Sun Jun 16, 2013 2:06 pm

No, saw it just today for the first time. Maybe the same code will work on many of them because it's written by the same guy.
You don't have to use it...Just passed it along.
GEGeek - I don't reinvent the wheel, I just link to it.
Image
http://www.gegeek.com
GEGeek
 
Posts: 158
Joined: Wed Feb 13, 2013 8:20 am
Location: NJ

Re: Fake Antivirus Product Keys Site

Postby Xander » Mon Jun 17, 2013 12:58 am

Hey, it's not a complaint; just pessimistic that something this guy found 6 months ago will still be valid today. It's worth a shot; costs nothing to try.
User avatar
Xander
 
Posts: 662
Joined: Fri Feb 08, 2013 6:08 pm
Location: Near Niagara Falls

Re: Fake Antivirus Product Keys Site

Postby GEGeek » Mon Jun 17, 2013 7:33 am

Well if that was the case then I apologize. Like I always said, you need to careful with the written word. Terse comments leave much to the imagination. Careful and considerate thought should go into all replies so as not to be misunderstood by some, of which apparently I was guilty of. In doing so, I believe more would contribute here and join the "team" of helping and sharing with each other, no matter their skill level. I believe in being polite at all times!
Mike
GEGeek - I don't reinvent the wheel, I just link to it.
Image
http://www.gegeek.com
GEGeek
 
Posts: 158
Joined: Wed Feb 13, 2013 8:20 am
Location: NJ

Re: Fake Antivirus Product Keys Site

Postby und3rtak3r » Mon Jun 17, 2013 9:29 am

If I were half as polite, and a quarter as useful on this site as either of you I would be 20 times the person..
you know i saw the post then the 1st comment.. and that comment put the information from the site into balance.. we need 10 or more of you here.. cause that is what i look for.. We are techs, not teenagers looking for the one up on others. Websites change so do people, what is sound today is rubbish tomorrow.. IT IS because of you guys i want to put more in.. someday it will be useful stuff..

i am an Aussie, with a brash bush humour.. and I have politely insulted more people than I care to mention.. Hell, I even insult politely.. and right now trying to be politely polite in the politest way...

And for the Aussie's who visit here to understand what I said up there here is a translation:- "When you Sepo's are finished kissing, can we get back to some serious s*it here...But if ya can breed a few more of ya's we will love yous just the bit more.. and When Origin is over this useless prick will spend more time here movin some s*it."
The TechGuru4U
RTFM D7 here
RTFM D7II here
RTFM dSupportSuite Here


You may call me Glenn
User avatar
und3rtak3r
 
Posts: 306
Joined: Mon Mar 18, 2013 8:05 pm

Re: Fake Antivirus Product Keys Site

Postby GEGeek » Mon Jun 17, 2013 9:52 am

Agreed - Well enough of this "polite" stuff We have work to do. :)
So in keeping on topic, I would like to submit another site for evaluation.
http://freeofvirus.blogspot.com/2009/05/remove-fake-antivirus-10.html "Remove Fake Virus"
Alway nice to have dedicated resources for these fake programs.
Mike
GEGeek - I don't reinvent the wheel, I just link to it.
Image
http://www.gegeek.com
GEGeek
 
Posts: 158
Joined: Wed Feb 13, 2013 8:20 am
Location: NJ

Re: Fake Antivirus Product Keys Site

Postby und3rtak3r » Mon Jun 17, 2013 10:21 am

Not so sure about that one: Chrome set off alarms.. ONLY for the download.. MBAM and BG scanned the download as OK?????

I'll check the malware notes against my other info..

I had a look at the information for some of the removals:
Code: Select all
Internet Security Premium should be removed immediately!
 Internet Security Premium Removal Guide
 Kill Process
 [random].exe
Delete Registry
HKEY_LOCAL_MACHINE\Software\itdefender.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Internet Security Premium" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "itdefender.exe"
Remove Folders and Files
%CommonAppData%\[random]
%LocalAppData%\[random]
%LocalAppData%\[random].exe
%Temp%\[random]
%UserProfile%\Templates\[random]


and

Code: Select all
Win 7 Smart Defender should be removed immediately!
Win 7 Smart Defender Removal Guide
Kill Process
[random].exe

Delete Registry

HKEY_CLASSES_ROOT\.exe "(Default)" = "[random]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pcdfdata
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = ""%CommonAppData%\pcdfdata\[random].exe" /ex "%1" %*"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "pcdfsvc" = "%CommonAppData%\pcdfdata\[random].exe /min"


Remove Folders and Files

%AllUsersProfile%\Desktop\Win 7 Smart Defender.lnk
%CommonAppData%\pcdfdata
%CommonStartMenu%\Programs\Win 7 Smart Defender
The TechGuru4U
RTFM D7 here
RTFM D7II here
RTFM dSupportSuite Here


You may call me Glenn
User avatar
und3rtak3r
 
Posts: 306
Joined: Mon Mar 18, 2013 8:05 pm

Re: Fake Antivirus Product Keys Site

Postby Xander » Mon Jun 17, 2013 10:22 am

Mike, don't confuse "straightforward and factual" with "rude". Please don't call out our members and offer lectures on courtesy - we're not kids who need things sugarcoated.

I'd seen that link on TN last week; thought it was you - my mistake. Point still stands that one code for all the variants of this stuff stands a very small chance of working. Again, hard to call it a "dedicated resource" when he posts every other month with the same code. Bleepingcomputer is a dedicated resource; this guy is a casual blogger with very little to offer.
User avatar
Xander
 
Posts: 662
Joined: Fri Feb 08, 2013 6:08 pm
Location: Near Niagara Falls

Re: Fake Antivirus Product Keys Site

Postby GEGeek » Mon Jun 17, 2013 10:39 am

That's good und3rtak3r. I have to admit the little hairs on the back of neck stood up when I first went to the site. I was a little suspicious but wasn't sure why.
Maybe it was the pink color :) Dunno. If you find anything please let me know, I'll take it off my list.
Thanks
Mike
GEGeek - I don't reinvent the wheel, I just link to it.
Image
http://www.gegeek.com
GEGeek
 
Posts: 158
Joined: Wed Feb 13, 2013 8:20 am
Location: NJ

Next

Return to Malware Removal