Home Malware Programs Trojans Trojan.Win32.FraudPack.zcs

Trojan.Win32.FraudPack.zcs

Posted: November 4, 2009

Trojan.Win32.FraudPack.zcs is a malicious trojan horse or bot that may represent a high security risk for the compromised system or its network environment. Trojan.Win32.FraudPack.zcs, which is also known as Mal/FakeAV-AD, creates a startup registry entry and may display annoying fake alerts of malware payloads in order to persuade users into buying rogue antispyware products. Trojan.Win32.FraudPack.zcs contains characteristics of an identified security risk and should be executed once detected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CommonAppData%\24990933\24990933.bat
    2 %CommonAppData%\24990933\24990933.exe
    3 %DesktopDir%\Security Tool.lnk
    4 %Programs%\Security Tool.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}[HKEY_CURRENT_USER\Control Panel\Desktop]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Loading...