FakeAlert-KS.gen.e
FakeAlert-KS.gen.e is a Trojan infection that is able to block legitimate anti-virus software and access your computer system without your consent and knowledge. Once active, FakeAlert-KS.gen.e will install corrupt files and entries to make the PC run abnormally. FakeAlert-KS.gen.e will change system settings and collect personal information to forward it to a remote attacker. FakeAlert-KS.gen.e should be deleted from the infected computer system immediately with a reliable anti-malware tool.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:%Profiles%\LocalService\Application Data\mvhgkr.dat
File name: %Profiles%\LocalService\Application Data\mvhgkr.datFile type: Data file
Mime Type: unknown/dat
%AppData%\avdrn.dat
File name: %AppData%\avdrn.datFile type: Data file
Mime Type: unknown/dat
%DesktopDir%\Internet Security 2010.lnk
File name: %DesktopDir%\Internet Security 2010.lnkFile type: Shortcut
Mime Type: unknown/lnk
%Temp%\dfgdgdfgrgdgfdrdfs.tmp
File name: %Temp%\dfgdgdfgrgdgfdrdfs.tmpFile type: Temporary File
Mime Type: unknown/tmp
c:\12.tmp
File name: c:\12.tmpFile type: Temporary File
Mime Type: unknown/tmp
c:\14.tmp
File name: c:\14.tmpFile type: Temporary File
Mime Type: unknown/tmp
%Windir%\Temp\hsf78w3uhduf8w.tmp
File name: %Windir%\Temp\hsf78w3uhduf8w.tmpFile type: Temporary File
Mime Type: unknown/tmp
%Windir%\Temp\Temporary Internet Files\Content.IE5\MDE3KROJ\in[1].txt
File name: %Windir%\Temp\Temporary Internet Files\Content.IE5\MDE3KROJ\in[1].txtMime Type: unknown/txt
%Windir%\Temp\Temporary Internet
File name: %Windir%\Temp\Temporary Internet%System%\41.exe
File name: %System%\41.exeFile type: Executable File
Mime Type: unknown/exe
%System%\lowsec\user.ds
File name: %System%\lowsec\user.dsMime Type: unknown/ds
%System%\wsnpoem\audio.dll
File name: %System%\wsnpoem\audio.dllFile type: Dynamic link library
Mime Type: unknown/dll
%System%\smss32.exe
File name: %System%\smss32.exeFile type: Executable File
Mime Type: unknown/exe
%System%\winlogon32.exe
File name: %System%\winlogon32.exeFile type: Executable File
Mime Type: unknown/exe
Registry Modifications
HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}\InProcServer32 (Default) = "%System%\x5i4y0v55p.dll" ThreadingModel = "Apartment"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D} (Default) = "%System%\x5i4y0v55p.dll" ThreadingModel = "Apartment"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}\InProcServer32HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop NoChangingWallpaper = 0x00000001 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoSetActiveDesktop = 0x00000001NoActiveDesktopChanges = 0x00000001HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NTHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestoreHKEY_LOCAL_MACHINE\SOFTWARE\AGProtectHKEY_USERS\.DEFAULT\Software\Microsoft\Protected Storage System ProviderHKEY_CURRENT_USER\Software\IS2010HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reader_s = "%System%\reader_s.exe" smss32.exe = "%System%\smss32.exe"
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.