Home Malware Programs Trojans FakeAlert-KS.gen.e

FakeAlert-KS.gen.e

Posted: August 29, 2011

FakeAlert-KS.gen.e is a Trojan infection that is able to block legitimate anti-virus software and access your computer system without your consent and knowledge. Once active, FakeAlert-KS.gen.e will install corrupt files and entries to make the PC run abnormally. FakeAlert-KS.gen.e will change system settings and collect personal information to forward it to a remote attacker. FakeAlert-KS.gen.e should be deleted from the infected computer system immediately with a reliable anti-malware tool.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Profiles%\LocalService\Application Data\mvhgkr.dat File name: %Profiles%\LocalService\Application Data\mvhgkr.dat
File type: Data file
Mime Type: unknown/dat
%AppData%\avdrn.dat File name: %AppData%\avdrn.dat
File type: Data file
Mime Type: unknown/dat
%DesktopDir%\Internet Security 2010.lnk File name: %DesktopDir%\Internet Security 2010.lnk
File type: Shortcut
Mime Type: unknown/lnk
%Temp%\dfgdgdfgrgdgfdrdfs.tmp File name: %Temp%\dfgdgdfgrgdgfdrdfs.tmp
File type: Temporary File
Mime Type: unknown/tmp
c:\12.tmp File name: c:\12.tmp
File type: Temporary File
Mime Type: unknown/tmp
c:\14.tmp File name: c:\14.tmp
File type: Temporary File
Mime Type: unknown/tmp
%Windir%\Temp\hsf78w3uhduf8w.tmp File name: %Windir%\Temp\hsf78w3uhduf8w.tmp
File type: Temporary File
Mime Type: unknown/tmp
%Windir%\Temp\Temporary Internet Files\Content.IE5\MDE3KROJ\in[1].txt File name: %Windir%\Temp\Temporary Internet Files\Content.IE5\MDE3KROJ\in[1].txt
Mime Type: unknown/txt
%Windir%\Temp\Temporary Internet File name: %Windir%\Temp\Temporary Internet
%System%\41.exe File name: %System%\41.exe
File type: Executable File
Mime Type: unknown/exe
%System%\lowsec\user.ds File name: %System%\lowsec\user.ds
Mime Type: unknown/ds
%System%\wsnpoem\audio.dll File name: %System%\wsnpoem\audio.dll
File type: Dynamic link library
Mime Type: unknown/dll
%System%\smss32.exe File name: %System%\smss32.exe
File type: Executable File
Mime Type: unknown/exe
%System%\winlogon32.exe File name: %System%\winlogon32.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}\InProcServer32 (Default) = "%System%\x5i4y0v55p.dll" ThreadingModel = "Apartment"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D} (Default) = "%System%\x5i4y0v55p.dll" ThreadingModel = "Apartment"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5BF49A2-94F1-42BD-F434-3604812C807D}\InProcServer32HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop NoChangingWallpaper = 0x00000001 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoSetActiveDesktop = 0x00000001NoActiveDesktopChanges = 0x00000001HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NTHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestoreHKEY_LOCAL_MACHINE\SOFTWARE\AGProtectHKEY_USERS\.DEFAULT\Software\Microsoft\Protected Storage System ProviderHKEY_CURRENT_USER\Software\IS2010HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reader_s = "%System%\reader_s.exe" smss32.exe = "%System%\smss32.exe"
Loading...