Trojan.Win32.FakeAV.doq

Technical Details
Payload
Removal instructions

Technical Details

This Trojan simulates an antivirus program to get compensated by the user for the detection and deletion of false threats. It is a Windows application (PE EXE file). It is 1 039 872 bytes in size. It is written in C++.

Installation

Once launched, the Trojan moves its original file and saves it as

%USERPROFILE%\Local Settings\Application Data\<rnd>.exe

where <rnd> is a random decimal number.

Every time when launched, the Trojan creates the following system registry key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"<name of original Trojan file>" = "%USERPROFILE%\Local Settings\Application Data\<rnd>.exe"

This ensures that the Trojan will launch automatically each time the system is restarted.

The Trojan also creates the following shortcut:

%USERPROFILE%\Start Menu\Programs\Security Tool.lnk

The shortcut points to the object:

%USERPROFILE%\Local Settings\Application Data\<rnd>.exe

Payload

Once launched, the Trojan simulates a computer file system scan and displays information about false threats:

When trying to remove the threats displayed by the Trojan, the user will be asked to activate the program:

The sites will then be displayed where the user is asked to input the credit card information to purchase a license:

defe***tgate.com
secu***soft.com

During its operations, the Trojan prevents new processes from being launched. When the Trojan discovers a launched process, it terminates it and displays the following window:

For example:

During its operation, the Trojan displays the following messages in the notification area:

The Trojan can also display a message that program updates are available:

During its operation, the Trojan sends a request to the following address:

212.***.107.202

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Reboot the computer in Safe Mode (at the start of the boot sequence, press and hold F8, then choose Safe Mode from the Windows boot menu).
2. Delete the following files:

   %USERPROFILE%\Local Settings\Application Data\.exe
   %USERPROFILE%\Start Menu\Programs\Security Tool.lnk
   

3. Delete the following system registry key (see What is a system registry and how do I use it?):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "" = "%USERPROFILE%\Local Settings\Application Data\.exe"
   

4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: D7F29FBD718066B0112AF79FDC656D67 SHA1: BD796ED40EC3AAB01A36E97D46F47377A0028917