Name:

LNK.Fraudtool.Winrestore.A

Added:

May 10 2011

Type:

Fraudtool

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When LNK.Fraudtool.Winrestore.A is executed, it installs a fake Windows Recovery Tool and performs the following activities:

It drops a copy of itself at the location:
%ALLUSERSPROFILE%\Application Data

and will add a registry entry in the Run section of the current user.

Sample screenshots of LNK.Fraudtool.Winrestore.A are shown below