Trojan.Win32.FakeAV.doq

From Total Malware Info

It is a trojan that imitates the work of anti-virus program for the purpose of obtaining the user fee for the detection and removal of non-existent threats. It is a Windows application (PE-EXE file). Its size is 1,039,872 bytes. It is written in C++.

MD5: D7F29FBD718066B0112AF79FDC656D67

SHA1: BD796ED40EC3AAB01A36E97D46F47377A0028917

Installation

Once launched, the trojan moves its original file and saves it as

%USERPROFILE%\Local Settings\Application Data\<rnd>.exe

here <rnd> - a random decimal number.

After every launch the trojan creates the following registry key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"<the original trojan file's name>" = "%USERPROFILE%\Local Settings\Application Data\<rnd>.exe"

It allows the trojan to automatically start its executable every time you start the system.

In addition, the trojan creates the shortcut:

%USERPROFILE%\Start Menu\Programs\Security Tool.lnk

It refers to the item:

%USERPROFILE%\Local Settings\Application Data\<rnd>.exe

Payload

Once launched, the trojan simulates the process of scanning victim's computer file system, thus displaying the information about the presence of non-existent threats:

When you try to remove the displayed threats, the trojan will offer you to pass the activation:

Then the sites containing webforms for entering user's credit card data will be displayed:

defen*****ymentgate.com
secu*****soft.com

The trojan blocks the launch of new processes in system. When the new process is found, it will be terminated, and the following window will be displayed:

For example:

The trojan displays the following messages in the taskbar notification area:

The trojan also may display the message about the availability of database updates:

In addition, the trojan connects to the following address:

212.150.***.202

Removal Instructions

If your computer was not protected by an antivirus and was infected with this malware, follow these steps to remove it:

1. Restart the computer in "Safe Mode" (at the beginning of loading press and hold «F8», then select «Safe Mode» at the Windows boot menu).

2. Delete the following files:

%USERPROFILE%\Local Settings\Application Data\<rnd>.exe
%USERPROFILE%\Start Menu\Programs\Security Tool.lnk

3. Delete the system registry key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"<the original trojan file's name>" = "%USERPROFILE%\Local Settings\Application Data\<rnd>.exe"

4. Perform a full system scan with an antivirus with updated databases.