Rogue AV: Antivirus Plus

Here’s another Rogue AV using the same animated system scan on the internet browser as the one in a previous post

In some instances, Antivirus Plus uses this animated scan instead:

It also uses one of those warnings that look oh so genuinely sincere:

Then of course downloading and installing the rogue app give us the usual scan results:

Here’s a list of domains currently serving this rogue app:


hxxp://adoimi.cn
hxxp://yourguardpro.cn
hxxp://yourcheckpoisonpro.cn
hxxp://yourfriskviruspro.cn
hxxp://antivirusplus09.com
hxxp://antivirusplus-ok.com
hxxp://addedantiviruspro.com


Because of the same animated system scan that they use, I reckon System Security and Antivirus Plus are two related rogue apps.