McAfee > Theat Center > Virus Detail Page

Overview

Similar to other malwares of this family, FakeAlert-D shows a fake warning message, alarming the user that their machine is infected or at risk. The intention behind all the fake messages is drive users to download the advertised antispyware product.

Characteristics

Upon executation, it installs itself at:

• %Windir%\System32\WinAvX.exe

(Where %Windir% is the Windows folder; e.g. C:\Windows)

The trojan displays a popup dialog with a message like the one shown in the picture below.

It also installs a taskbar icon that displays a bogus warning message as below:

Upon clicking the fake warning message the browser will be redirected to http://{blocked}.winantivirus.com or http://freere{blocked}tympegs.com/movie/{random}/{random}/{random}/, directing the users to download an antispyware product "WinAntiVirus Pro" which can be detected as potentially unwanted program WinFixer.

In addition, this trojan attempts to terminates security product -related processes from a hardcoded list of filenames and Window names:

It will also overwrite the system hosts located at %Windir%\System32\drivers\etc\hosts to direct the following known domain names to a local IP address in an attempt to block security updates. The list contains several known advertising-related sites.

www3.ca.com
www.virustotal.com
www.viruslist.ru
www.viruslist.com
www.trendmicro.com
www.symantec.com
www.symantec.com
www.sophos.com
www.pandasoftware.com
www.networkassociates.com
www.nai.com
www.my-etrust.com
www.microsoft.com
www.mcafee.com
www.kaspersky.ru
www.kaspersky.com
www.kaspersky-labs.com
www.grisoft.com
www.fastclick.net
www.f-secure.com
www.ca.com
www.awaps.net
www.avp.ru
www.avp.com
www.avp.ch
windowsupdate.microsoft.com
virustotal.com
virusscan.jotti.org
viruslist.ru
viruslist.com
vil.nai.com
us.mcafee.com
updates5.kaspersky-labs.com
updates4.kaspersky-labs.com
updates3.kaspersky-labs.com
updates2.kaspersky-labs.com
updates1.kaspersky-labs.com
updates.symantec.com
update.symantec.com
trendmicro.com
symantec.com
support.microsoft.com
spd.atdmt.com
sophos.com
service1.symantec.com
securityresponse.symantec.com
secure.nai.com
rads.mcafee.com
phx.corporate-ir.net
pandasoftware.com
office.microsoft.com
norton.com
networkassociates.com
nai.com
my-etrust.com
msdn.microsoft.com
microsoft.com
media.fastclick.net
mcafee.com
mast.mcafee.com
liveupdate.symantecliveupdate.com
liveupdate.symantec.com
kaspersky.com
kaspersky-labs.com
ids.kaspersky-labs.com
go.microsoft.com
ftp.sophos.com
ftp.kasperskylab.ru
ftp.f-secure.com
ftp.downloads3.kaspersky-labs.com
ftp.downloads2.kaspersky-labs.com
ftp.downloads1.kaspersky-labs.com
ftp.avp.ch
fastclick.net
f-secure.com
engine.awaps.net
downloads4.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads.microsoft.com
downloads-us3.kaspersky-labs.com
downloads-us2.kaspersky-labs.com
downloads-us1.kaspersky-labs.com
download.microsoft.com
download.mcafee.com
dispatch.mcafee.com
customer.symantec.com
clicks.atdmt.com
click.atdmt.com
ca.com
banners.fastclick.net
banner.fastclick.net
awaps.net
avp.ru
avp.com
avp.ch
atdmt.com
ar.atwola.com
ads.fastclick.net
ad.fastclick.net
ad.doubleclick.net

The modified hosts file can be detected as QHosts-54 trojan.

Symptoms

• Display of the popup alert dialogs mentioned.
• Presence of the mentioned file(s).
• Modification of the hosts file as mentioned.
• Modifies the default start and search page to:
• www.google.com/ie
• Creation of the following registry key(s) to hook startup:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"WinAVX" = "%Windir%\System32\WinAvX.exe"
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"WinAVX" = "%Windir%\System32\WinAvX.exe"
• Creation of the following registry key(s) to modifiy system configuration:
• HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel =  0x00000001
• HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate = 0x00000001

Method of Infection

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Removal

All Users:
Use specified engine and DAT files for detection.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the current engine and the specified DATs (or higher). Older engines may not be able to remove all registry keys created by this threat.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

Similar to other malwares of this family, FakeAlert-D shows a fake warning message, alarming the user that their machine is infected or at risk. The intention behind all the fake messages is drive users to download the advertised antispyware product.

Characteristics

Characteristics -

Upon executation, it installs itself at:

• %Windir%\System32\WinAvX.exe

(Where %Windir% is the Windows folder; e.g. C:\Windows)

The trojan displays a popup dialog with a message like the one shown in the picture below.

It also installs a taskbar icon that displays a bogus warning message as below:

Upon clicking the fake warning message the browser will be redirected to http://{blocked}.winantivirus.com or http://freere{blocked}tympegs.com/movie/{random}/{random}/{random}/, directing the users to download an antispyware product "WinAntiVirus Pro" which can be detected as potentially unwanted program WinFixer.

In addition, this trojan attempts to terminates security product -related processes from a hardcoded list of filenames and Window names:

It will also overwrite the system hosts located at %Windir%\System32\drivers\etc\hosts to direct the following known domain names to a local IP address in an attempt to block security updates. The list contains several known advertising-related sites.

www3.ca.com
www.virustotal.com
www.viruslist.ru
www.viruslist.com
www.trendmicro.com
www.symantec.com
www.symantec.com
www.sophos.com
www.pandasoftware.com
www.networkassociates.com
www.nai.com
www.my-etrust.com
www.microsoft.com
www.mcafee.com
www.kaspersky.ru
www.kaspersky.com
www.kaspersky-labs.com
www.grisoft.com
www.fastclick.net
www.f-secure.com
www.ca.com
www.awaps.net
www.avp.ru
www.avp.com
www.avp.ch
windowsupdate.microsoft.com
virustotal.com
virusscan.jotti.org
viruslist.ru
viruslist.com
vil.nai.com
us.mcafee.com
updates5.kaspersky-labs.com
updates4.kaspersky-labs.com
updates3.kaspersky-labs.com
updates2.kaspersky-labs.com
updates1.kaspersky-labs.com
updates.symantec.com
update.symantec.com
trendmicro.com
symantec.com
support.microsoft.com
spd.atdmt.com
sophos.com
service1.symantec.com
securityresponse.symantec.com
secure.nai.com
rads.mcafee.com
phx.corporate-ir.net
pandasoftware.com
office.microsoft.com
norton.com
networkassociates.com
nai.com
my-etrust.com
msdn.microsoft.com
microsoft.com
media.fastclick.net
mcafee.com
mast.mcafee.com
liveupdate.symantecliveupdate.com
liveupdate.symantec.com
kaspersky.com
kaspersky-labs.com
ids.kaspersky-labs.com
go.microsoft.com
ftp.sophos.com
ftp.kasperskylab.ru
ftp.f-secure.com
ftp.downloads3.kaspersky-labs.com
ftp.downloads2.kaspersky-labs.com
ftp.downloads1.kaspersky-labs.com
ftp.avp.ch
fastclick.net
f-secure.com
engine.awaps.net
downloads4.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads.microsoft.com
downloads-us3.kaspersky-labs.com
downloads-us2.kaspersky-labs.com
downloads-us1.kaspersky-labs.com
download.microsoft.com
download.mcafee.com
dispatch.mcafee.com
customer.symantec.com
clicks.atdmt.com
click.atdmt.com
ca.com
banners.fastclick.net
banner.fastclick.net
awaps.net
avp.ru
avp.com
avp.ch
atdmt.com
ar.atwola.com
ads.fastclick.net
ad.fastclick.net
ad.doubleclick.net

The modified hosts file can be detected as QHosts-54 trojan.

Symptoms

Symptoms -

• Display of the popup alert dialogs mentioned.
• Presence of the mentioned file(s).
• Modification of the hosts file as mentioned.
• Modifies the default start and search page to:
• www.google.com/ie
• Creation of the following registry key(s) to hook startup:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"WinAVX" = "%Windir%\System32\WinAvX.exe"
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"WinAVX" = "%Windir%\System32\WinAvX.exe"
• Creation of the following registry key(s) to modifiy system configuration:
• HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel =  0x00000001
• HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate = 0x00000001

Method of Infection

Method of Infection -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the current engine and the specified DATs (or higher). Older engines may not be able to remove all registry keys created by this threat.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A