AV Security Suite is a Fake Antivirus application. This security risk can be downloaded by clicking on certain Internet advertisements, but it must be manually installed. When a user downloads AV Security Suite and runs a scan, the program reports false scan alerts. The user is then prompted to pay for a full license of the application in order to remove the threats.

Type: Misleading Application
Infection Length: 286,464 bytes
Name: AV Security Suite
Risk Impact: Medium
Systems Affected: Windows 2000, Windows Server 2003, Windows Vista, Windows XP
Behavior: AVSecuritySuite is a misleading application that may give exaggerated reports of threats on the computer.

AV Security Suite Removal

Installation

When the program is executed, it creates the following file:
%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe

Next, the program creates the following registry entries so that it executes whenever Windows starts:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”[EIGHT RANDOM CHARACTERS]” = “%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe”
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”[EIGHT RANDOM CHARACTERS]” = “%UserProfile%\Local Settings\Application Data\[FIRST SET OF RANDOM CHARACTERS]\[SECOND SET OF RANDOM CHARACTERS]tssd.exe”

It also modifies the following registry entries to lower Internet Explorer security settings:

  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\”CheckExeSignatures” = “no”
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\”RunInvalidSignatures” = “1”
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\”EnabledV8″ = “0”
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter\”Enabled” = “0”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\”SaveZoneInformation” = “1”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\”LowRiskFileTypes” = “.exe”

It also creates the following registry subkeys:

  • HKEY_LOCAL_MACHINE\SOFTWARE\AVSuitE
  • HKEY_LOCAL_MACHINE\SOFTWARE\avSofT
  • HKEY_CURRENT_USER\Software\avSofT

How to Remove AV Security Suite
The following instructions pertain to all current and recent Symantec Antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

  1. Disable System Restore (Windows Me/XP).
  2. Update the virus definitions.
  3. Run a full system scan.
  4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

if you do not have Norton Antivirus, you can download a free copy of Malwarebytes’ Anti-Malware to remove this software.

See more fake antivirus removal instructions here.