Im-Infected / Rogue / AntiMalware Lab

AntiMalware Lab

This part of web site contains full description and analysis on AntiMalware Lab as well as removal procedures and necessary tools.

Options : » Discuss » Print » Bookmark

Date Posted: July 6th, 2011

Discussion: One Response

AntiMalware Lab is a must-remove program that will pretend as anti-malware software. This program may look and act as if it was a legitimate tool in removing Trojans, virus and other sorts of computer infection, but in reality it was just developed to deceive computer users and earn a profit from this illegal online activities. Just as any fake security application, Anti-Malware Lab has a payment processing web site where victims will be redirected it they want to clean detected threats from the computer. During the scan provided by AntiMalware Lab, several threats will be detected. It will prompt the user to remove them and as mentioned, it will ask for credit card information that will be used for payment transaction.

Ignore AntiMalware Lab virus and all of its pop-up alerts and warning messages. Everything it present are just part of its techniques to sell the program. Removing AntiMalware Lab does not require its own licensed version. The only thing needed is real and trusted security program. As stated on this page, legitimate anti-malwa re program can be used in removing AntiMalware Lab and all of the files and components it has planted on the computer.

Type Rogue
Sub-Type FakeAV
Aliases Anti-Malware Lab
OS Affected Windows
Detected By MalwareBytes

What are the Symptoms of AntiMalware Lab Infection?

It will modify Windows Registry and add the following entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Anti-Malware Lab”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “[random].exe”
HKEY_CLASSES_ROOT\PersonalSS.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1″
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “ProxyServer” = “http=127.0.0.1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options “Debugger” = “svchost.exe”

The threat will drop the following malicious files:
%UserProfile%\Application Data\Anti-Malware Lab\
%UserProfile%\Application Data\Anti-Malware Lab\cookies.sqlite
%UserProfile%\Application Data\Anti-Malware Lab\Instructions.ini
%Documents and Settings%\All Users\Application Data\(random)\
%Documents and Settings%\All Users\Application Data\(random)\(random).exe
%Documents and Settings%\All Users\Application Data\(random)\(random).mof
%Documents and Settings%\All Users\Application Data\(random)\(random).dll
%Documents and Settings%\All Users\Application Data\(random)\(random).ocx
%Documents and Settings%\All Users\Application Data\(random)\(random)\

How to Remove AntiMalware Lab Virus Manually

1. Restart your computer in SafeMode
- Press F8 on keyboard as soon as you turn on the computer
- Select SafeMode to start the computer loading only minimal resources

2. Delete Windows registry entries the malware created. It is important to BACKUP YOUR REGISTRY FIRST.
- On Windows Start Menu, Click Start > Run
- Type in the field, regedit
- Find registry entries mentioned above and delete if necessary

3. Files related to AntiMalware Lab must be deleted:
- Browse and delete malicious files detected above.
- Some files cannot be deleted instantly. Press Ctrl+Alt+Del to open Windows Task Manager, look for any virus-related files mentioned on this page and highlight it, click End Process. Try to delete the file once more.

4. Run Antivirus Program
- You must be connected to Internet to be able to update your anti-virus program. This is needed to have the latest database available and detect newer threats.
- Thoroughly scan the computer and clean or delete all detected threats.

How to Easily Remove AntiMalware Lab Virus

1. Print this procedure as we need to close all running programs later.
2. Download AntiMalware Application here and save it to your Desktop.
3. Close all open applications.
4. Double-Click on the downloaded mbam-setup.exe to start the installation. If unable to execute, infections on computer is preventing it from running, rename the file mbam-setup.exe to anything (like myfile.exe)
5. Run the installation on the default settings. No changes are necessary.
6. Just before completing the installation, make sure that the following are marked check.
- Update the program
- Launch the program

7. The tool will run and update itself after installation. Close it after the update.

8. Restart your computer in SafeMode
- After Power-On the computer, just before Windows start, press F8
- From the selections, Select SafeMode

9. Click on the icon and start to Perform Full Scanto begin scanning your computer for AntiMalware Lab related files.
10. After scanning, a message will appear stating that the scan is completed successfully. Click OK.
11. Click Show Results and detected threats will be displayed.
12. Make sure that all threats are marked check, then click Remove Selected to begin removal of the malicious files.
13. Exit AntiMalware Apps and restart your computer.

14. AntiMalware Lab and all its files are now removed from your computer. To guard your computer from this threat and avoid future infections, you may want real-time protection from AntiMalware Apps.

AntiMalware Lab Discussions

  1. leslie wand
    July 10th, 2011 at 09:30 | #1

    have a socomec ups system

    i am getting repeated malware reports (running latest version malwarebytes anti-malware with latest updates) in the latest uni vision software supplied by socomec!?

    the reported malware is

    ============================================
    Malwarebytes’ Anti-Malware 1.51.0.1200
    www. malwarebytes.org

    Database version: 7060

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 9.0.8112.16421

    10/07/2011 6:51:00 PM
    mbam-log-2011-07-10 (18-50-47).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 328953
    Time elapsed: 47 minute(s), 14 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\program files (x86)\socomec ups\univision\config.exe (Rogue.AntiMalwareLab) -> No action taken.
    c:\program files (x86)\socomec ups\univision\univision-auto.exe (Rogue.AntiMalwareLab) -> No action taken.
    c:\program files (x86)\socomec ups\univision\univision.exe (Rogue.AntiMalwareLab) -> No action taken.

    ============================================

    is this legit?

  1. No trackbacks yet.