Omid Farhang
SafetyAntiSpyware (branded in the wild as Safety Anti-Spyware 3) is rogue anti-spyware. The behavior matches the usual scareware pattern from that period: invent threats, then sell a license to “remove” them.
What it does
First it “detects” fake infections. Then it asks the user to license the product and keeps nagging until someone pays. Activation does not make the machine safer.
When it showed up in the wild: New rogue: SafetyAntiSpyware. To clean an infected PC, use the Malware Removal guide for Windows.
Known System Changes
Files
%Desktop%\Safety Anti-Spyware 3.lnk%ProgramFiles%\Safety Anti-Spyware 3\Safety Anti-Spyware 3.exe
Folders
%ProgramFiles%\Safety Anti-Spyware 3%StartMenu%\Safety Anti-Spyware 3
Registry Entries
- Key:
HKEY_CURRENT_USER\Software\21CDEB48ECA505D5BCF7433258F34A70 - Key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Safety Anti-Spyware 3 - Key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - Value:
Safety Anti-Spyware 3