FakeRean

FakeRean Description

FakeRean is a label that covers a family of rogue security programs that include fake spyware products like Spyware Protection, fake anti-virus products like Vista Antivirus 2011, general security products like Win 7 AntiMalware 2010 and dozens of other such scamware programs. Although different FakeRean infections may be slightly varied in more characteristics than just their names, our malware experts have found a number of commonalities between even the most disparate FakeRean infections, including fake infection warnings, browser-hijacking behavior and a complete lack of genuine security features. Although all of the many different types of FakeRean rogue security programs are entirely malicious, new versions have been altered to be even more difficult to remove, and you shouldn’t hesitate to use suitable anti-malware software to delete FakeRean infections instead of trying to do alone and unassisted.

A Flip Through FakeRean in Its Thousand Variations

FakeRean is a relatively clinical term for what most Internet-goers know by a variety of scamware product names. As an infection that creates an illusion of being a security program, FakeRean relies on lack of recognition, along with the use of friendly-seeming standard imagery such as Norton shield icons and the Windows style blue-windowed interface to remain uncaught. As a result, FakeRean is always changing its name and evolving into a new form of itself, as you can see below.

A few further examples of some of FakeRean’s other and well-publicized names include Win 7 Anti-Virus 2012, Vista Anti-virus 2012, Vista Anti-virus 2012, Vista Defender Pro, XP Total Security 2011, Vista Anti-Virus 2011, Vista Home Security 2011, XP Antispyware 2012 and Vista Antivirus Pro 2010. It’s also worth noting that SpywareRemove.com malware researchers have found that many variants of FakeRean are capable of creating fake product names either with or without the year-based suffix, and may even attempt to detect your version of Windows to sync their name with your PC.

The foremost threat with any FakeRean infection is the danger in taking its fake infection warnings at their word. FakeRean will always create numerous fake infection alerts and other types of warnings (such as fake scanner results) that make it look like your PC is heavily-infected.

However, SpywareRemove.com malware researchers have never observed any real PC threat detection or removal features in any of FakeRean’s many rogue security programs, even though FakeRean will insist that purchasing its software is the only way to cure your many infections.

Hence, this is simply a ploy to steal your money and credit card information, which should never be handed over to websites that are linked to FakeRean.

A few samples of just some of the many possible errors that FakeRean gives out are shown below:

Spyware alarm!
Our scan has reported that pieces of malicious spyware code are present on your hard drive. To get rid of security threats, click here for a [FakeRean rogue security program name] scan.

Windows Security Center reports that [FakeRean rogue security program name] is enable. [FakeRean rogue security program name] helps to protect your computer against viruses and other security threats. Click Recommendations for the suggested actions. Your system might be at risk now.
Note: Windows has detected an unregistered version of ‘[FakeRean rogue security program name]‘

Trojan detected!
A piece of malicious code was found in your system, which can replicate itself if no action is taken. Clicked here to have your system cleaned by [FakeRean rogue security program name].

WARNING! [FakeRean rogue security program name] has found [random number] useless and UNWANTED files on your computer!

The New Evolution in FakeRean Security Scamware

Our malware experts have also been troubled by noticing that recent versions of FakeRean have displayed additional features that make the FakeRean removal process additionally difficult. This includes:

Browser hijacks that redirect your browser to FakeRean’s website or simply away from security-related sites. In some cases, the technique that FakeRean uses to hijack your browser is specific to Internet Explorer and won’t affect other browsers.
FakeRean will also launch itself without permission, and advanced versions of FakeRean can even do so every time an .exe file is launched. It’s particularly difficult to delete FakeRean under these circumstances, since FakeRean will activate whenever you try to launch an appropriate anti-malware program.

However, as gruesome as these attacks are, standard anti-malware techniques, such as Safe Mode and specialized anti-malware tools, can overcome all of FakeRean’s interferences. Because of the high probability of heavy Registry changes, the registration of .dll or .cab files and other advanced FakeRean attacks, you shouldn’t try to remove FakeRean without software-based assistance, since improper removal of FakeRean may cause serious damage to Windows.

Aliases

TROJ_FAKEAV.ROE [TrendMicro]W32/FakeAV.PSO [Norman]a variant of Win32/Kryptik.EHO [NOD32]FakeAlert-DeskTopSec.gen [McAfee]Generic17.BZMB [AVG]Malware-Cryptor.Win32.Gron.2 [VBA32]a variant of Win32/Kryptik.EGQ [NOD32]Trojan.Fakealert.15579 [DrWeb]ASD.Prevention [AhnLab-V3]Trojan.FraudPack.ADQS [VirusBuster]

More aliases (127)

FakeRean Automatic Detection Tool (Recommended)

Is your PC infected with FakeRean? To safely & quickly detect FakeRean, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect FakeRean What happens if FakeRean does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	%TEMP%\ m.2F7.tmp.exe	548
2	%TEMP%\ m.21E.tmp.exe	438
3	%LOCALAPPDATA%\ Microsoft\ Windows\ Temporary Internet Files\ Content.IE5\ FV3G78HU\ go[1].exe	384
4	%TEMP%\ m.21A.tmp.exe	330
5	%TEMP%\ m.2BFB4.tmp.exe	241
6	%TEMP%\ 30D5.tmp	220
7	%LOCALAPPDATA%\ Microsoft\ Windows\ Temporary Internet Files\ Content.IE5\ 0WGOFKJ8\ movie[1].exe	21
8	%TEMP%orary Internet Files\ Content.IE5\ Q8ACKL3P\ antivirus[2].exe	12