Home Malware Programs Trojans Trojan.FakeAV!gen40

Trojan.FakeAV!gen40

Posted: October 19, 2010

Trojan.FakeAV!gen40 is a malicious trojan horse that may represent a high security risk for the compromised system or its network environment. Trojan.FakeAV!gen40 creates a startup registry entry and may display annoying fake alerts of malware payloads in order to persuade users to buy rogue antispyware products. Trojan.FakeAV!gen40 contains characteristics of an identified security risk and should be removed immediately once detected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Microsoft\stor.cfg
    2 %AppData%\Microsoft\svchost.exe
    3 %AppData%\Microsoft\Windows\shell.exe
    4 %Temp%\dwm.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings]HKEY..\..\..\..{RegistryKeys}ProxyEnable =
Loading...