Symptoms

Removal instructions:

Analyzed By

Technical Description:

The malware simulates an antivirus product that scans the computer, alerting the user that some threats were found but they cannot be removed unless the user registers (pays) for the full version of the product.  In fact, all those infections are unreal, the only purpose of this fake antivirus being to determine the user to pay.
 
 The main window of this malware looks like the screenshot below:




 If the user does not choose to pay for the full version, annoying popups will impede him working on the computer. This popups look like:



The malware will create a directory named Aav in the program files directory (c:\Program files\Aav) where it will drop the following files:
        aav.cpl, aav.exe, aav.ooo, aav1.dat.
It will also create a shortcut link to the c:\Program files\Aav\aav.exe file and it will put it on the desktop.