Remove VirusRescue
Posted on: May 3rd, 2009
| Discovered: | February 13, 2007 |
| Updated: |
February 13, 2007 11:51:08 AM |
| Type: |
Misleading Application |
| Systems Affected: |
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP |
| Recommended Action: | |
In order to Remove VirusRescue you need to Download the ‘No Adware’ remover software. Based on our testing this was the best peforming remover of Remove VirusRescue.. |
|
| Technical Details: |
| Once executed, the Trojan performs the following actions:
1. Creates the following files: * %ProgramFiles%\VirusRescue\Languages\english.ini * %ProgramFiles%\VirusRescue\Logs * %ProgramFiles%\VirusRescue\Logs\. * %ProgramFiles%\VirusRescue\Logs\.. * %ProgramFiles%\VirusRescue\OE.api * %ProgramFiles%\VirusRescue\OE4.api * %ProgramFiles%\VirusRescue\TheBAT.api * %ProgramFiles%\VirusRescue\UnACE.api * %ProgramFiles%\VirusRescue\UnARJ.api * %ProgramFiles%\VirusRescue\UnMSCAB.api * %ProgramFiles%\VirusRescue\VirusRescue.exe * %ProgramFiles%\VirusRescue\VirusRescue.tlb * %ProgramFiles%\VirusRescue\VirusRescue.url * %ProgramFiles%\VirusRescue\asc4.dll * %ProgramFiles%\VirusRescue\backdoor.avb * %ProgramFiles%\VirusRescue\base.dat * %ProgramFiles%\VirusRescue\ca.avb * %ProgramFiles%\VirusRescue\config.ini * %ProgramFiles%\VirusRescue\daily.avb * %ProgramFiles%\VirusRescue\kernel4.avb * %ProgramFiles%\VirusRescue\kernel40.dll * %ProgramFiles%\VirusRescue\malware.avb * %ProgramFiles%\VirusRescue\pl.dll * %ProgramFiles%\VirusRescue\sdebug.log * %ProgramFiles%\VirusRescue\stop.set * %ProgramFiles%\VirusRescue\stopapi4.dll * %ProgramFiles%\VirusRescue\tips.txt * %ProgramFiles%\VirusRescue\uninst.exe * %ProgramFiles%\VirusRescue\unrar.api * %ProgramFiles%\VirusRescue\unzip.api * %ProgramFiles%\VirusRescue\virusdos.avb * %ProgramFiles%\VirusRescue\virusw32.avb * %ProgramFiles%\VirusRescue\vrExt.dll * %ProgramFiles%\VirusRescue\vrsvc.exe * %ProgramFiles%\VirusRescue\weekly.avb * %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusRescue v3.0.1.lnk * %UserProfile%\Desktop\VirusRescue v3.0.1.lnk * %UserProfile%\Local Settings\Temp\VRLanguage.ini * %UserProfile%\Start Menu\Programs\VirusRescue\ VirusRescue v3.0.1 Un-Installer.lnk * %UserProfile%\Start Menu\Programs\VirusRescue\ VirusRescue v3.0.1 Website.lnk * %UserProfile%\Start Menu\Programs\VirusRescue\ VirusRescue v3.0.1.lnk * %UserProfile%\Start Menu\VirusRescue v3.0.1.lnk Note: * %UserProfile% is a variable that refers to the current user’s profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP). * %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files. 2. Creates the following registry subkeys: HKEY_CLASSES_ROOT\VRExt.VRShlExt HKEY_CLASSES_ROOT\VRExt.VRShlExt.1 HKEY_CLASSES_ROOT\AppID\VRExt.DLL HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\VRShlExt HKEY_CLASSES_ROOT\AppID\{53A8703F-53BF-4C44-8DAF-FA254A1E1B8C} HKEY_CLASSES_ROOT\AppID\{CF79DAB6-0AFE-4678-856D-44574D91915C} HKEY_CLASSES_ROOT\CLSID\{598CA4D5-6870-47F0-B513-E3EFBA809B22} HKEY_CLASSES_ROOT\CLSID\{753D7DED-2454-44A3-959D-DC3700FC6B6E} HKEY_CLASSES_ROOT\CLSID\{CF79DAB6-0AFE-4678-856D-44574D91915C} HKEY_CLASSES_ROOT\CLSID\{F80DB5A5-A885-7370-4983-841F62A80AF2} HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\VRShlExt HKEY_CLASSES_ROOT\Interface\{598CA4D5-6870-47F0-B513-E3EFBA809B22} HKEY_CLASSES_ROOT\Interface\{679B00B5-0783-4DE4-A478-7227FDD50825} HKEY_CLASSES_ROOT\TypeLib\{2E88F662-2027-421D-9874-F3DBC2207BAB} HKEY_CLASSES_ROOT\TypeLib\{C7DF0578-D732-4BFB-A65B-89C1CCEA01CC} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \App Paths\virusrescue.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\VirusRescue HKEY_LOCAL_MACHINE\SOFTWARE\VirusRescue 3. Adds the registry value: “VirusRescue” = “%ProgramFiles%\VirusRescue\VirusRescue.exe /s” to the registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Run so that it runs every time Windows starts. 4. Displays message boxes giving exaggerated reports of threats on the computer and urging the user to purchase a registered version of the software. |
| Action Steps: |
FREE SCAN: NoAdware can Remove VirusRescue. Click the link below
for your free download & scan your PC now. Please click here for manual removal instructions. |
In order to Remove VirusRescue you need to 

