Content
FakeAlert-AO
- Type
- Trojan
- SubType
- Win32
- Discovery Date
- 06/24/2008
- Length
- varies
- Minimum DAT
- 5324 (06/24/2008)
- Updated DAT
- 5350 (07/30/2008)
- Minimum Engine
- 5.1.00
- Description Added
- 06/24/2008
- Description Modified
- 06/24/2008 9:56 PM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/
When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.
System Changes
Upon Installation the trojan adds the following registry keys
- HKEY_CURRENT_USER\Software\IEAntiVirus
Path = "C:\Program Files\IEAntiVirus
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
antispy = "C:\Program Files\IEAntiVirus\ANTIVIR.exe"
The trojan installs the following files:
- %USERPROFILE%\Start Menu\Programs\IE AntiVirus 3.3.lnk
- c:\Program Files\IEAntiVirus\antivir.exe
- c:\Program Files\IEAntiVirus\ieav.db2
- c:\Program Files\IEAntiVirus\ieav.db3
- c:\Program Files\IEAntiVirus\ieav.db4
- c:\Program Files\IEAntiVirus\license.txt
- c:\Program Files\IEAntiVirus\uninst.exe
Symptoms
Presence of aforementioned files and registry keys.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/
Similar to other malwares of this family, FakeAlert-AO shows a fake warning message, alarming the user that their machine is infected or at risk. The intention behind all the fake messages is drive users to purchase the advertised product.
Characteristics
Characteristics -
-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/
When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.
System Changes
Upon Installation the trojan adds the following registry keys
- HKEY_CURRENT_USER\Software\IEAntiVirus
Path = "C:\Program Files\IEAntiVirus
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
antispy = "C:\Program Files\IEAntiVirus\ANTIVIR.exe"
The trojan installs the following files:
- %USERPROFILE%\Start Menu\Programs\IE AntiVirus 3.3.lnk
- c:\Program Files\IEAntiVirus\antivir.exe
- c:\Program Files\IEAntiVirus\ieav.db2
- c:\Program Files\IEAntiVirus\ieav.db3
- c:\Program Files\IEAntiVirus\ieav.db4
- c:\Program Files\IEAntiVirus\license.txt
- c:\Program Files\IEAntiVirus\uninst.exe
Symptoms
Symptoms -
Presence of aforementioned files and registry keys.
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
