Name:

Trojan.FakeAV.acvy

Added:

February 10, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Trojan.FakeAV.acvy is executed, it performs the following activities:

It creates the following folder:

%Program Files%\McAVG\McAVG

It drops the following files:

%Program Files%\McAVG\McAVG\fasdata1.dat
%Program Files%\McAVG\McAVG\fasdata2.dat
%Program Files%\McAVG\McAVG\fasdata3.dat
%Program Files%\McAVG\McAVG\fasdata4.dat
%Program Files%\McAVG\McAVG\fasdata5.dat
%Program Files%\McAVG\McAVG\fasdata6.dat
%Program Files%\McAVG\McAVG\fasdata7.dat
%Program Files%\McAVG\McAVG\fasdata8.dat
%Program Files%\McAVG\McAVG\lastscan.txt
%Program Files%\McAVG\McAVG\licencia.txt
%Program Files%\McAVG\McAVG\mcavg.exe

After execution it displays fake threat messages and forces user to
purchase the software in order to remove the fake threats: