print version

Antivirus IS

6th November 2010

Antivirus IS - One Program that IS not Good for Your Computer

Good antivirus software is a must in today's cyber-dependent world, but there are many choices out there that aren't quite as friendly as they may seem. Antivirus IS is just one of these programs, and if it's installed on your computer, the best possible thing you can do is to remove it right away.

What Is Antivirus IS

The program itself is called rogue antivirus software or rogue security software, and the real goal is to get you to buy the whole version of the program. This action, though, simply isn't in your best interest. Actual antivirus programs are created with the right coding to be able to scan through your files, detect ones that resemble or are viruses, then hold them safely or delete them to help keep your computer from more serious harm. In the case of Antivirus IS, though, that absolutely isn't the case. It's simply designed to get you to buy the whole version of the program, which then offers the potential for additional security holes on your computer. The necessary coding to be able to detect viruses and other malware is not built into this program.

Antivirus IS is related to other rogue security programs including Security Suite, AV Security Suite, and Antivirus Soft. These three programs look and behave alike, and if you have one of them installed on your machine, it's not wholly uncommon to notice that more than one of them has taken up residence on your computer as well.

If you do have Antivirus IS, you're likely to notice a number of different things:

• One of the biggest factors in this program is the virus scanner. It has the ability to pop up at any time that your computer is actually on, and while it looks like your standard virus scanner, it can't actually detect any infections on your machine. In the top left corner of the program, you'll see a shield logo that looks a bit like that of Windows Defender. The text beside the logo reads "Antivirus IS" and "Innovative Protection for your PC." Just below that on the left, you'll see a number of different menu options including "Performing Scan," "Adjust Settings," "Get Updates," "Activate Now," and "Help and Support." The rest of the program is devoted to the scan window itself, and it lets you know when it is "performing" a scan as well as what malware names it found during the scan. The actual infections found don't exist on your computer, and like many of the functions of this program, they're shown just to frighten you into making a purchase. When the scanner has finished, you'll see a screen that asks you to remove the infected files. None of them can be removed, though, without purchasing the full version of the program.
• Another thing many people notice is security warnings. These come in the form of pop up advertisements as well as Windows Notification balloons. Most of these come in the form of security notifications, and they often take place after you've tried to launch a particular program. One fairly common one reads:

Security Warning

Application cannot be executed. The file notepad.exe is infected. Do you want to activate your antivirus software now.

Other warnings you may see on your computer include:

Windows Security Alert

Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the can your computer. Your system might be at risk now.

Antivirus Software Alert

Infiltration Alert

Your computer is being attacked by an internet virus. It could be a password-stealing attack, Trojan - dropper or similar.

Threat: Win32/Nuqel.E

Do you want to block this attack?

• As indicated by the first warning, Antivirus IS can actually block your attempt to reach certain programs on your machine. This is actually a self-preservation tactic, as it doesn't want you to access any programs that might be able to delete it, so it simply doesn't allow you to load those in the attempt to protect itself. These programs can include task manager, Internet Explorer, or any other preloaded security software you may have on your machine.
• One final way that Antivirus IS can affect your computer is that it can reconfigure your Proxy Server. That means that when you browse online, you may begin to get warning notifications and pages instead of what you actually clicked on. While all of these warnings are completely false, they may look a bit frightening, and they can prevent you from reaching your destination. The most typical text of the warning messages reads:

Internet Explorer warning - visiting this site may harm your computer! Most likely causes:

The website contains exploits that can launch a malicious code on your computer

Suspicious network activity detected

There might be an active spyware running on your computer

What you can try:

Purchase for secure Internet surfing (recommended)

Click for your computer viruses and malware

Removing Antivirus IS

Antivirus IS removal should become your primary priority if it is installed on your machine, and there are two primary ways to handle it - manually or through a good security program. It's important to note that most antivirus software can't remove this program for you, even if you already have a good solution installed on your machine. You may need a more comprehensive security suite, as in some cases, antivirus software can't recognize Antivirus IS because it's not technically a virus. It is rogue security software.

If you choose to remove Antivirus IS manually, you'll be editing your computer's registry and removing program files. This can be tough if you're a bit non-technical, and in some cases, it may even be dangerous to your computer. You can, however, email us for help and a list of detailed instructions. You will have to make Windows Explorer show you all of the hidden files temporarily as you work to get rid of Antivirus IS. A list of files and registry keys that need to be removed appears at the end of this article.

The far easier way to remove Antivirus IS is to turn to the help of a solid antispyware scanner like Malwarebytes Anti-Malware (Malwarebytes has free malware removal) or PC Tools' Spyware Doctor. Download, install, and update the program, then run the scanner. It will detect the problem, and remove it immediately. Set it to update automatically and scan on a regular basis, and you'll have the comprehensive security protection you need well into the future.

Associated Files and Registry Keys:

HKEY_CURRENT_USER\Software\mksybupgw
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter "Enabled" = "0"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:27811"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyEnable" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "lanw.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "lanw.exe"

%Temp%\\
%Temp%\\lanw.exe

 to top