Home Malware Programs Rogue Anti-Spyware Programs FakeXPA

FakeXPA

Posted: November 30, 2010

Threat Metric

Threat Level: 10/10
Infected PCs: 3,038
First Seen: November 30, 2010
Last Seen: January 23, 2022
OS(es) Affected: Windows

FakeXPA is a family of rogue anti-virus programs (such as Green AV or Antivirus 2009) that disable legitimate anti-malware products and display fake warnings about PC threats on your computer. Although error messages from FakeXPA-based scamware can be ignored without harm, the security attacks noted above will cause your PC to be exceptionally vulnerable to other attacks, and thus, an active FakeXPA infection should be considered to have the potential to be a high-level threat. FakeXPA rogue anti-malware programs have seen new variants and updates even in 2011 and may require up-to-date threat databases before actual anti-malware scanners can identify and remove them with total accuracy.

FakeXPA – a Huckster with Friends in the Spying Business

FakeXPA includes similar types of rogue anti-virus programs that all use similar attacks against your PC, most-notably including fake warning messages and attempts to sabotage the executable (or .exe) files of real anti-malware software. Some common names for FakeXPA-based scamware include Total Security, Antivir, Earth Antivirus, Antivirus GT, XP Antivirus 2008, Antivirus 2010, Cyber Security and Personal Security. Aside from their differing names and aesthetic tweaks, SpywareRemove.com malware experts note that these programs can be considered to be functionally identical to each other.

Along with having multiple components for themselves, rogue AV programs from the FakeXPA family may also install other PC threats, especially Alureon Trojans. W32/Alureon Trojans use a variety of methods, such as attacking your DNS settings, to spy on and steal private information. This can include passwords, account names and financial information.

The Difference Between FakeXPA and Legitimate PC Security

Fake warning messages from FakeXPA, although they may look legitimate, lack any relevant or accurate content about your computer's health. Samples that SpywareRemove.com malware researchers have gathered include:

Warning! Identity theft attempt detected!
Attacker IP:
Attack Target: Microsoft Corp. Keys
Description: Remote host tries to get access to your personal information.

Windows Security Alert
Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan your computer. Your system might be at risk now.

Warning!
VirtuMonde is an adware program that tends to monitor your Internet browsing habits and may display targeted advertisements onto your computer screen. Virtumonde may also create a malicious DLL file in order to log your keystrokes and send the recorded information to a third party website. Virtumonde is an unwanted application and recommended to be removed.

Antivirus software alert
Infiltration alert
Your computer is being attacked by an Internet virus. It could be password-stealing attack, a Trojan-dropper or similar.

Warning! New virus detected!
Threat Detected: Keylogger.iSnake.Pro
Infected File: C:\WINDOWS\system32\asr_ldm.exe

Since there aren't any circumstances where heeding FakeXPA's advice could result in positive results for your PC, the best thing that you can do is ignore them until you can delete FakeXPA itself. In particular, purchasing FakeXPA-based scamware should be considered a total and needless waste of your money. Unfortunately, removing FakeXPA scamware can be made difficult due to the fact that FakeXPA has a predilection for attacking the .exe files of real anti-malware programs. FakeXPA scamware products are known to target the following files with NTFS disk-writing attacks:

  • afwServ.exe
  • avp.exe
  • avgcclix.dll
  • avgnsx.exe
  • avgrsx.exe
  • avgcsrvx.exe
  • avgam.exe
  • avgfws.exe
  • avgtray.exe
  • avgwdsvc.exe
  • avastUI.exe
  • AvastSvc.exe
  • ccSvcHst.exe
  • mcagent.exe
  • mcmscsvc.exe
  • mcregist.exe
  • mcnasvc.exe
  • McSACore.exe
  • mcshield.exe
  • mcsysmon.exe
  • MPFSrv.exe
  • MskSrver.exe

However, since these attacks may not disable your anti-malware software until you restart your PC, FakeXPA can still be removed by anti-malware programs as long as you do so before FakeXPA's disk-writing attack has taken effect. SpywareRemove.com malware researchers also recommend disabling FakeXPA and then reinstalling your anti-malware programs as an effective solution.

Aliases

Downloader.Generic8.BSRD [AVG]W32/PackBredolab.C!tr [Fortinet]Win-Downloader/Zlob.173056 [AhnLab-V3]Win32/FakeXP.J [eTrust-Vet]Trojan.Packed.19697 [DrWeb]Trojan:W32/XPAntivirus.gen!L [F-Secure]Troj/FakeAv-AAQ [Sophos]Trojan.Generic.2503965 [BitDefender]Trojan-Downloader.Win32.FraudLoad.fmh [Kaspersky]Win32:MalOb-CA [Cryp] [Avast]Trojan.FakeAV!gen5 [Symantec]W32/FakeAV.MN [F-Prot]Win32/Adware.Antivirus2009.AA [NOD32]FakeAlert-IS [McAfee]TrojanDownloader.FraudLoad.fm [CAT-QuickHeal]
More aliases (474)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\E-Set 2011\e-set.exe File name: e-set.exe
Size: 1.68 MB (1681408 bytes)
MD5: 2830867abf0a4585f68bda47b8e4a107
Detection count: 93
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\E-Set 2011
Group: Malware file
Last Updated: March 21, 2011
%USERPROFILE%\Desktop\powersecure_2053_ibr8.exe File name: powersecure_2053_ibr8.exe
Size: 242.17 KB (242176 bytes)
MD5: 730f23c83957ec25e8b4e0a04420d993
Detection count: 54
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Desktop
Group: Malware file
Last Updated: July 11, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.3 MB (1303552 bytes)
MD5: 222ce2263b8e92c61284bb1b4c704ae5
Detection count: 37
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: February 9, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.66 MB (1662976 bytes)
MD5: 9967e5956005fc377605304e60ca4d78
Detection count: 35
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 24, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.65 MB (1651200 bytes)
MD5: c2089ab47353d142b7d1ea4b3f49562e
Detection count: 35
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 19, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.25 MB (1256448 bytes)
MD5: 0e8f4807cad312f597cfe7dbcf2261ad
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 16, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.65 MB (1651200 bytes)
MD5: 23ef8ad8894754b6b031ef59d024a8dd
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 24, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.65 MB (1651200 bytes)
MD5: c880fa52d8ec65e792fe694212c29eed
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 16, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.3 MB (1302528 bytes)
MD5: 8a8d987f61778c0b60b30b6f991a5f52
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: February 10, 2011
%WINDIR%\system32\msiexecs.exe File name: msiexecs.exe
Size: 1.67 MB (1679872 bytes)
MD5: de8634ff52b49a1c0ebb36b1ffa2cf43
Detection count: 21
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: June 16, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.25 MB (1250304 bytes)
MD5: 4fb3fa33ae7c845218cbe54d13c9bb9f
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: February 1, 2011
%USERPROFILE%\Eigene Dateien\Soft_95.exe File name: Soft_95.exe
Size: 173.05 KB (173056 bytes)
MD5: 3734185c9e1bdd05bb9b077ee4f32878
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Eigene Dateien
Group: Malware file
Last Updated: April 16, 2013
%PROGRAMFILES%\AVG Antivirus 2011\avg.exe File name: avg.exe
Size: 1.7 MB (1709568 bytes)
MD5: d568107809815871a46169f63ac52e0c
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\AVG Antivirus 2011
Group: Malware file
Last Updated: February 10, 2011
%USERPROFILE%\Desktop\setup.exe File name: setup.exe
Size: 175.12 KB (175121 bytes)
MD5: 1694f0522272a4e732185c18aae9e3ba
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Desktop
Group: Malware file
Last Updated: April 4, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.34 MB (1346560 bytes)
MD5: 22a323b50a890f899c4800cf921ec2dc
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: March 6, 2011
%WINDIR%\system32\iesafemode.exe File name: iesafemode.exe
Size: 1.71 MB (1712128 bytes)
MD5: ff0b1b68924b4ef31e11ec439602a266
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: March 14, 2011
%PROGRAMFILES%\E-Set 2011\e-set.exe File name: e-set.exe
Size: 1.67 MB (1678848 bytes)
MD5: fdcb6a236f1fe4f464ff6a9e0267d726
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\E-Set 2011
Group: Malware file
Last Updated: June 16, 2011
%PROGRAMFILES%\E-Set 2011\e-set.exe File name: e-set.exe
Size: 1.7 MB (1704960 bytes)
MD5: 1949f8303d9826221c04518bb3256056
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\E-Set 2011
Group: Malware file
Last Updated: April 18, 2011
%USERPROFILE%\Local Settings\Application Data\wdn.exe File name: wdn.exe
Size: 225.48 KB (225485 bytes)
MD5: f9f1dcfae3e975440a8e28ab751b0397
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Local Settings\Application Data
Group: Malware file
Last Updated: January 19, 2012
%PROGRAMFILES%\AVG Antivirus 2011\avg.exe File name: avg.exe
Size: 1.73 MB (1738240 bytes)
MD5: 1f79908e06cd00466b97f086b7cead16
Detection count: 2
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\AVG Antivirus 2011
Group: Malware file
Last Updated: January 1, 2012

More files

Related Posts

Loading...