FakeXPA

FakeXPA is a family of rogue anti-virus programs (such as Green AV or Antivirus 2009) that disable legitimate anti-malware products and display fake warnings about PC threats on your computer. Although error messages from FakeXPA-based scamware can be ignored without harm, the security attacks noted above will cause your PC to be exceptionally vulnerable to other attacks, and thus, an active FakeXPA infection should be considered to have the potential to be a high-level threat. FakeXPA rogue anti-malware programs have seen new variants and updates even in 2011 and may require up-to-date threat databases before actual anti-malware scanners can identify and remove them with total accuracy.

FakeXPA – a Huckster with Friends in the Spying Business

FakeXPA includes similar types of rogue anti-virus programs that all use similar attacks against your PC, most-notably including fake warning messages and attempts to sabotage the executable (or .exe) files of real anti-malware software. Some common names for FakeXPA-based scamware include Total Security, Antivir, Earth Antivirus, Antivirus GT, XP Antivirus 2008, Antivirus 2010, Cyber Security and Personal Security. Aside from their differing names and aesthetic tweaks, SpywareRemove.com malware experts note that these programs can be considered to be functionally identical to each other.

Along with having multiple components for themselves, rogue AV programs from the FakeXPA family may also install other PC threats, especially Alureon Trojans. W32/Alureon Trojans use a variety of methods, such as attacking your DNS settings, to spy on and steal private information. This can include passwords, account names and financial information.

The Difference Between FakeXPA and Legitimate PC Security

Fake warning messages from FakeXPA, although they may look legitimate, lack any relevant or accurate content about your computer's health. Samples that SpywareRemove.com malware researchers have gathered include:

Warning! Identity theft attempt detected!
Attacker IP:
Attack Target: Microsoft Corp. Keys
Description: Remote host tries to get access to your personal information.

Windows Security Alert
Windows reports that computer is infected. Antivirus software helps to protect your computer against viruses and other security threats. Click here for the scan your computer. Your system might be at risk now.

Warning!
VirtuMonde is an adware program that tends to monitor your Internet browsing habits and may display targeted advertisements onto your computer screen. Virtumonde may also create a malicious DLL file in order to log your keystrokes and send the recorded information to a third party website. Virtumonde is an unwanted application and recommended to be removed.

Antivirus software alert
Infiltration alert
Your computer is being attacked by an Internet virus. It could be password-stealing attack, a Trojan-dropper or similar.

Warning! New virus detected!
Threat Detected: Keylogger.iSnake.Pro
Infected File: C:\WINDOWS\system32\asr_ldm.exe

Since there aren't any circumstances where heeding FakeXPA's advice could result in positive results for your PC, the best thing that you can do is ignore them until you can delete FakeXPA itself. In particular, purchasing FakeXPA-based scamware should be considered a total and needless waste of your money. Unfortunately, removing FakeXPA scamware can be made difficult due to the fact that FakeXPA has a predilection for attacking the .exe files of real anti-malware programs. FakeXPA scamware products are known to target the following files with NTFS disk-writing attacks:

• afwServ.exe
• avp.exe
• avgcclix.dll
• avgnsx.exe
• avgrsx.exe
• avgcsrvx.exe
• avgam.exe
• avgfws.exe
• avgtray.exe
• avgwdsvc.exe
• avastUI.exe
• AvastSvc.exe
• ccSvcHst.exe
• mcagent.exe
• mcmscsvc.exe
• mcregist.exe
• mcnasvc.exe
• McSACore.exe
• mcshield.exe
• mcsysmon.exe
• MPFSrv.exe
• MskSrver.exe

However, since these attacks may not disable your anti-malware software until you restart your PC, FakeXPA can still be removed by anti-malware programs as long as you do so before FakeXPA's disk-writing attack has taken effect. SpywareRemove.com malware researchers also recommend disabling FakeXPA and then reinstalling your anti-malware programs as an effective solution.

Technical Details