rdevereux
2009-03-17, 16:31
There appears to be a new piece of spyware that looks like a variant of the Antivirus2009 stuff that was around a few months ago. It calls itself av360 and auto-installs from infected websites.
It creates, as far as I can tell, a folder under c:\program files called av360 and has a single .exe in there called av360.exe. This is called from an entry in Hkey_Current_user/Software/Microsoft/Windows/Current version/Run with a random numerical name and the path to the .exe named above.
I cant find any other entries but spybot 1.62 with latest updates didnt find it so was wondering if any other info is known and also if there is an update that includes a signature file for this software.
Rob
It creates, as far as I can tell, a folder under c:\program files called av360 and has a single .exe in there called av360.exe. This is called from an entry in Hkey_Current_user/Software/Microsoft/Windows/Current version/Run with a random numerical name and the path to the .exe named above.
I cant find any other entries but spybot 1.62 with latest updates didnt find it so was wondering if any other info is known and also if there is an update that includes a signature file for this software.
Rob