11.02.2008

VirusHeat


Updated: February 11, 2008 1:13:15 PM
Type: Misleading Application
Name: VirusHeat
Version: 3.9
Publisher: www.virusheat.com
Risk Impact: Medium
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

SUMMARY

Behavior

VirusHeat is a misleading application that may give exaggerated reports of threats on the computer.

Protection

  • Initial Rapid Release version pending
  • Latest Rapid Release version pending
  • Initial Daily Certified version February 11, 2008 revision 022
  • Latest Daily Certified version February 11, 2008 revision 022
  • Initial Weekly Certified release date February 13, 2008

TECHNICAL DETAILS

Behavior
The program must be manually installed.

The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the errors.





Installation
When the program is executed, it creates the following files:
  • %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk
  • %UserProfile%\Desktop\VirusHeat 3.9.lnk
  • %UserProfile%\Start Menu\Programs\VirusHeat 3.9\Uninstall VirusHeat 3.9.lnk
  • %UserProfile%\Start Menu\Programs\VirusHeat 3.9\VirusHeat 3.9 Website.lnk
  • %UserProfile%\Start Menu\Programs\VirusHeat 3.9\VirusHeat 3.9.lnk
  • %UserProfile%\Start Menu\VirusHeat 3.9.lnk
  • %Temp%\VPPLanguage.ini
  • %ProgramFiles%\VirusHeat 3.9\blacklist.txt
  • %ProgramFiles%\VirusHeat 3.9\Lang\English.ini
  • %ProgramFiles%\VirusHeat 3.9\msvcp71.dll
  • %ProgramFiles%\VirusHeat 3.9\msvcr71.dll
  • %ProgramFiles%\VirusHeat 3.9\uninst.exe
  • %ProgramFiles%\VirusHeat 3.9\vht.dat
  • %ProgramFiles%\VirusHeat 3.9\VirusHeat 3.9.exe
  • %ProgramFiles%\VirusHeat 3.9\VirusHeat 3.9.url


It also creates the following folders:
  • %ProgramFiles%\VirusHeat 3.9\Lang
  • %ProgramFiles%\VirusHeat 3.9\Logs
  • %ProgramFiles%\VirusHeat 3.9\Quarantine


Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"VirusHeat 3.9" = "C:\Program Files\VirusHeat 3.9\VirusHeat 3.9.exe"

It then creates the following registry subkeys:
  • HKEY_CLASSES_ROOT\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}
  • HKEY_CLASSES_ROOT\Interface\{0979850F-6C3E-4294-B225-B3D3C4A6F2A1}
  • HKEY_CLASSES_ROOT\Interface\{1BB2DA5F-B78F-44EA-BDA1-771CBE1DEC68}
  • HKEY_CLASSES_ROOT\Interface\{2A4E73C5-BA3C-4391-B7E5-FFE8D3BD6245}
  • HKEY_CLASSES_ROOT\Interface\{44A923CA-F430-4F85-9F84-5153ECDB882E}
  • HKEY_CLASSES_ROOT\Interface\{4E6E21EC-9D72-4164-8A53-74786A467872}
  • HKEY_CLASSES_ROOT\Interface\{631E9E48-B066-43DA-92AC-6DADF61B173B}
  • HKEY_CLASSES_ROOT\Interface\{65C1361C-E696-4AF0-9E21-81910193F352}
  • HKEY_CLASSES_ROOT\Interface\{77DCE805-C8CE-48AA-A47F-BFA6CC7704B3}
  • HKEY_CLASSES_ROOT\Interface\{8D42769F-07D8-494D-AAB4-AA1652C541FA}
  • HKEY_CLASSES_ROOT\Interface\{A1922071-390C-418D-916D-91209E95D286}
  • HKEY_CLASSES_ROOT\Interface\{A1F8CD95-CFB3-43D1-A956-63441CC058C1}
  • HKEY_CLASSES_ROOT\Interface\{A63B46AD-96A7-4A2C-BD8F-8CD097E1593A}
  • HKEY_CLASSES_ROOT\Interface\{A65F98DD-2360-468C-B76E-B1B84C0D547C}
  • HKEY_CLASSES_ROOT\Interface\{AE2AEED0-BE1B-4BA2-826E-20D1991081B8}
  • HKEY_CLASSES_ROOT\Interface\{D7F73787-6206-4BBA-BDC0-7CFA9940DBCB}
  • HKEY_CLASSES_ROOT\Interface\{E770F739-2968-4ED9-A63C-DC1938DC82A2}
  • HKEY_CLASSES_ROOT\TypeLib\{CFAFA83C-855B-4E3D-92B9-A587995B675A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 3.9.exe 3.9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 3.9
  • HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 3.9


Similar Security Risks

VirusBurst