FakeSpyguard

Posted: September 15, 2009

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	72

First Seen:	July 24, 2009
OS(es) Affected:	Windows

FakeSpyGuard is a family of rogue anti-malware scanners that create inaccurate scan results and system alerts, all of which are designed to make FakeSpyGuard's victims panic and purchase the 'registered' version of the software as a quick remedy. Sadly, even registered members of FakeSpyGuard's family can't detect actual malware of any type, and SpywareRemove.com malware researchers also have observed variants of FakeSpyGuard downloading other Trojans, altering the Windows interface without any permission and creating fake malware files (harmless 'junk' files). Since FakeSpyGuard is a minor but distinct danger to your PC, you should take any necessary measure to identify any individual FakeSpyGuard infections and use real anti-malware products to remove FakeSpyGuard from your PC before any harm can be incurred from its presence.

A Guard You Shouldn't Hire Even On Its Best Day

FakeSpyGuard's family encompasses several fake anti-malware programs that try to confuse their victims into thinking that they have real anti-malware functions, with brand names including Spyware Guard 2008 (from which FakeSpyGuard derives its name), Malware Defender 2009 and System Guard 2009. Unlike more prolific and modern scamware families like WinWebsSec or FakeRean, FakeSpyGuard hasn't been found to hijack your web browser or attempt to block any other programs – but PC threats related to FakeSpyGuard infections still may accomplish these tasks. SpywareRemove.com malware researchers associate all variants of FakeSpyGuard with the following symptoms:

FakeSpyGuard may replace the Windows Security Center (replaced in recent versions of Windows with the equivalent Action Center) to include promotional links for whatever variant of FakeSpyGuard currently infects your PC – such as a request to activate a 'trial' version of System Guard 2009.
FakeSpyGuard pretends to be able to scan your PC to detect various types of malicious software, but FakeSpyGuard's results actually are predetermined, and always will identify fake infections that include high-level threats such as Trojan downloaders and spambots. Attempting to use FakeSpyGuard to remove these fake threats only will redirect you to a purchasable registration option.
Variants of FakeSpyGuard also will create pop-up warnings that alert you to fake attacks, such as attempted theft of personal information or unwanted system Registry changes. Some of these pop-ups may attempt alerts from Windows Security Center and other default Windows applications.

Taking FakeSpyGuard off the Shift

Like any incompetent guard that should be fired for failing to guard anything sufficiently well, FakeSpyGuard always should be deleted as soon as you notice its installation on your PC. Ordinarily, removing FakeSpyGuard should be a simple job that's manageable by any decent anti-malware utility, but various PC threats that may be accompanying FakeSpyGuard do have the potential to interfere with the easy deletion of FakeSpyGuard.

For disabling FakeSpyGuard and any other malware, SpywareRemove.com malware researchers usually recommend booting into Safe Mode, which is a security feature that's available on most major operating systems. If you still experience problems in removing FakeSpyGuard afterward, you also can consider booting your computer from an entirely uninfected source – such as an OS that's loaded onto a USB stick.

Aliases

SpywareGuard2008 [Symantec]Fraudulent Security Program [Prevx1]Adware/SpywareGuard2008 [Panda]Win32/TrojanDownloader.FakeAlert.SM [NOD32]not-a-virus:FraudTool.Win32.SpywareGuard2008.u [K7AntiVirus]Win32/FakeAV.SR [eTrust-Vet]Win32.PWS.Gamania.gen!D.8 [CAT-QuickHeal]Trojan.Downloader.FakeAlert.BG [BitDefender]Fake_AntiSpyware.ANK [AVG]Win32:Spyware-gen [Avast]W32/FakeAlert.FC [Authentium]PHISH/Fraud.SpywareGuard2008.L [AntiVir]Win-Trojan/FakeAlert.74245 [AhnLab-V3]FakeAlert-AG.gen.a [McAfee]Mal/EncPk-CZ [Sophos]
More aliases (28)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

winlogon.exe

File name: winlogon.exe
Size: 74.24 KB (74245 bytes)
MD5: e654d21760100c554d4f7f99180bab78
Detection count: 36
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009

Trojan.FakeSpyguard