McAfee > Theat Center > Virus Detail Page

Overview

Similar to other malwares of this family, FakeAlert-AO shows a fake warning message, alarming the user that their machine is infected or at risk. The intention behind all the fake messages is drive users to purchase the advertised product.

Characteristics

-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/

When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.

System Changes

Upon Installation the trojan adds the following registry keys

• HKEY_CURRENT_USER\Software\IEAntiVirus
  Path = "C:\Program Files\IEAntiVirus
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  antispy = "C:\Program Files\IEAntiVirus\ANTIVIR.exe"

The trojan installs the following files:

• %USERPROFILE%\Start Menu\Programs\IE AntiVirus 3.3.lnk
• c:\Program Files\IEAntiVirus\antivir.exe
• c:\Program Files\IEAntiVirus\ieav.db2
• c:\Program Files\IEAntiVirus\ieav.db3
• c:\Program Files\IEAntiVirus\ieav.db4
• c:\Program Files\IEAntiVirus\license.txt
• c:\Program Files\IEAntiVirus\uninst.exe

Symptoms

Presence of aforementioned files and registry keys.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/

Similar to other malwares of this family, FakeAlert-AO shows a fake warning message, alarming the user that their machine is infected or at risk. The intention behind all the fake messages is drive users to purchase the advertised product.

Characteristics

Characteristics -

-- Update June 24, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2008/06/24/scareware_knows_your_username/

When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.

System Changes

Upon Installation the trojan adds the following registry keys

• HKEY_CURRENT_USER\Software\IEAntiVirus
  Path = "C:\Program Files\IEAntiVirus
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  antispy = "C:\Program Files\IEAntiVirus\ANTIVIR.exe"

The trojan installs the following files:

• %USERPROFILE%\Start Menu\Programs\IE AntiVirus 3.3.lnk
• c:\Program Files\IEAntiVirus\antivir.exe
• c:\Program Files\IEAntiVirus\ieav.db2
• c:\Program Files\IEAntiVirus\ieav.db3
• c:\Program Files\IEAntiVirus\ieav.db4
• c:\Program Files\IEAntiVirus\license.txt
• c:\Program Files\IEAntiVirus\uninst.exe

Symptoms

Symptoms -

Presence of aforementioned files and registry keys.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A