Rogue AV: Antivirus Plus

Here's another Rogue AV out there, and it's being served by more than one domain:



Here's a list of some of the domains used to host this Rogue AV:

addedantiviruslive(dot)com
addedantivirusonline(dot)com
addedantivirusstore(dot)com
easyaddedantivirus(dot)com
freeantivirusplus09(dot)com
goodantivirusplus(dot)com
i-antivirusplus(dot)com
internetantivirusplus(dot)com
mybestantivirusplus(dot)com
myplusantiviruspro(dot)com
nextantivirusplus(dot)com
realantivirusplus09(dot)com
realbestantivirusplus(dot)com
yesantivirusplus(dot)com



Stay away from these rogue domains and block them if you have any means of doing so.

Rogue AV: Antivirus Plus

Here's another Rogue AV using the same animated system scan on the internet browser as the one in a previous post



In some instances, Antivirus Plus uses this animated scan instead:



It also uses one of those warnings that look oh so genuinely sincere:



Then of course downloading and installing the rogue app give us the usual scan results:



Here's a list of domains currently serving this rogue app:


hxxp://adoimi.cn
hxxp://yourguardpro.cn
hxxp://yourcheckpoisonpro.cn
hxxp://yourfriskviruspro.cn
hxxp://antivirusplus09.com
hxxp://antivirusplus-ok.com
hxxp://addedantiviruspro.com



Because of the same animated system scan that they use, I reckon System Security and Antivirus Plus are two related rogue apps.