AntivirusDoktor
Threat LevelDamageDistribution

Effects 

AntivirusDoktor is an adware program in German that carries out the following actions:

• It reaches the computer in a file which has the following icon:
  
  
• If users run the file, the program starts its installation. Once installed, the program has the following interface:
  
  
• If users click the Scan button (Scannen), it starts scanning the computer in search for possible malware.
• Once finished, it displays a warning message indicating that the computer is infected:
  
  
• In order to remove these threats, users are redirected to the website to register the program, where they will be requested to pay a certain sum of money:
  
  
• Additionally, if users do not follow the instructions of the program, it will periodically display messages like the following, reminding them that their computer is unprotected:
  
  

Infection strategy 

AntivirusDoktor creates the following folders:

• Antivirus Doktor 2009, in the Program files directory and in the Programs directory of the Start menu.
• AVP 2009, in the root directory of the C: drive.

Additionally, it creates a shortcut to the program called ANTIVIRUS DOKTOR 2009.LNK in the Desktop.

AntivirusDoktor creates the following entry in the Windows Registry:

• HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ Antivirus Doktor 2009_is1

Means of transmission 

AntivirusDoktor can be voluntarily downloaded from the website belonging to the company that has developed it.

Further Details  

AntivirusDoktor is 2,497,208 bytes in size.