Home Malware Programs Trojans Trojan.Win32.FakeAv.daup

Trojan.Win32.FakeAv.daup

Posted: July 15, 2011

Trojan.Win32.FakeAv.daup is a spyware Trojan that disables various security features on your PC, while attempting to steal online banking information. Any Trojan.Win32.FakeAv.daup infection is a gross breach of privacy as well as your computer's safety due to Trojan.Win32.FakeAv.daup's willingness to exploit the Windows Registry to make deep-seated and negative changes to your security settings. Although you may be able to find Trojan.Win32.FakeAv.daup's primary files inside of a Documents and Settings subfolder, deleting Trojan.Win32.FakeAv.daup with a good anti-malware program is better than relying on manual deletion methods to insure your PC safety.

The Invisible Security Risk That Trojan.Win32.FakeAv.daup Presents

Trojan.Win32.FakeAv.daup is a variant of the Trojan-Banker infection, an infamous Trojan that focuses on grabbing up online passwords and other account information. Although this is common behavior for many Trojans, Trojan.Win32.FakeAv.daup differentiates itself by focusing specifically on stealing online bank data, particularly from Wells Fargo Bank and Bank of America accounts. Trojan.Win32.FakeAv.daup infections may record your keyboard input, take screenshots, or rifle through your computer for stored password information.

Computers that are infected with Trojan.Win32.FakeAv.daup can suffer from a number of serious security attacks, almost all of which are done by abusing the Windows Registry:

  • Trojan.Win32.FakeAv.daup will exploit debugger modes to use special debugging privileges for malicious goals.
  • Trojan.Win32.FakeAv.daup can disable Windows alerts that would warn you about being redirecting from one URL to another one. This is a common attack that supplements browser hijacks which may attempt to change your website destinations, without your knowledge or permission.
  • Trojan.Win32.FakeAv.daup is even capable of disabling System Restore, a baseline Windows feature, that helps you 'roll back' your system to a previous and uninfected state.
  • As the cherry on top of this unpleasant dessert, Trojan.Win32.FakeAv.daup has also been seen disabling security-related programs, especially WinDefend. WinDefend, also known by the name Windows Defender, is an anti-spyware program that's included with Windows 7 by default. You may need to use separate anti-spyware applications to remove Trojan.Win32.FakeAv.daup from your PC.

Trojan.Win32.FakeAv.daup is Only Getting Started

Although the above attacks are Trojan.Win32.FakeAv.daup's most serious activities and should be taken with great seriousness, some versions of Trojan.Win32.FakeAv.daup may also interfere with your PC in other ways that aren't related to Trojan.Win32.FakeAv.daup's spyware or anti-security goals. Some of these other attacks can leave behind symptoms that help you see Trojan.Win32.FakeAv.daup at work before it's too late:

  • Trojan.Win32.FakeAv.daup will send out email messages with a built-in SMTP client. Although these messages will not appear in your online mailbox, they may spoof your sending address. This behavior is associated with 'spam' email and may cause an overall slowdown in your computer or poor interface responsiveness.
  • Trojan.Win32.FakeAv.daup will launch itself without your permission. Unlike many other Trojans, some versions of Trojan.Win32.FakeAv.daup don't make any effort to hide their memory processes or files. Because of this, you may be able to use the Task Manager to tell you whether or not Trojan.Win32.FakeAv.daup is active.
  • Most Trojan.Win32.FakeAv.daup infections use randomly-named .exe files that can be found in the Microsoft subdirectory of your Documents and Settings folder.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Microsoft\ebexqj.exe
    2 %AppData%\Microsoft\sloqys.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
Loading...