Name:

Trojan.FakeaAV.zsl

Added:

January 14, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Trojan.FakeaAV.zsl is executed, it performs the following activities:

After execution, it creates the following folder:

%temp%\Random name

It then drops the following file:

%temp%\Random name.exe [a copy of itself]

It creates the following registry entry:

Random name = "%temp%\Random name.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

After execution, it displays fake threat messages and forces a user to purchase the software in order to remove the fake threats: