MS Antivirus

MS Antivirus is an Rogue Anti-Virus program targeting the Microsoft Windows family of Operating Systems. MS Antivirus lists false infections on the host computer, and requires you to purchase the program before you can remove the claimed infections. [http://www.bleepingcomputer.com/malware-removal/remove-ms-antivirus]

Method of Infection/Variants

The program is downloaded via the Internet usually through the Zlob Trojan, or through Rogue Codec scams, such as such as Video ActiveX Enhancement 2.07. [http://www.enigmasoftware.com/support/msantivirus2008-removal] . MS Antivirus is also known as XP Antivirus [http://blogs.pcmag.com/securitywatch/2008/08/ms_antivirus_2008_morphed_from_xp_antivirus_2008.php] , Vitae Antivirus, Windows Antivirus, Antivirus 2008, System Antivirus,and Vista Antivirus. Generally these distributions come with a year marker, i.e. 2007/2008/2009.

Affected Operating Systems

MS Antivirus is only known to infect computers running the Microsoft Windows Operating System. The following Windows system may be infected: [http://malwaredatabase.net/blog/index.php/2008/08/21/ms-antivirus-2008]

* Windows 98
* Windows ME
* Windows 2000
* Windows XP
* Windows Vista

Symptoms of infection

In a typical installation, MS Antivirus 2008 runs a scan on the computer and gives a false spyware report claiming that the computer is infected with spyware. Once the scan is completed, a warning message appears that lists the spyware ‘found’ and the user has to either click on a link or a button to remove it. This deceptive tactic is an attempt to scare the Internet user into clicking on the link or button to purchase MS Antivirus 2008. If the user decides not to purchase the program, then they will constantly receive popups stating that the program has found infections and that they should register it in order to fix them. This type of behavior can cause a computer to operate slower than normal.

MS Antivirus will also occasionally display fake pop-up alerts on your computer. These alerts pretend to be a detection of an attack on your computer and the alert prompts you to activate, or purchase, the software in order to stop the attack. The Registry is also modified so the software runs at system startup. The following files may be downloaded to an infected computer:

* MSASetup.exe
* MSA.exe
* MSA.cpl
* MSx.exe
* karina.dat
* buritos.exe

Removal

MS Antivirus is constantly updated and re-released to prevent detection by common Anti-Virus scanners. It may be detected and removed by Spybot Search & Destroy, as well as Malwarebytes' Anti-Malware.

See also

* Rogue software
* Adware

External links

References