Name:

Trojan.FakeWindowsOptiCenter

Added:

February 8, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Trojan.FakeWindowsOptiCenter is executed, it performs the following activities:

It drops the following files:

C:\Documents and Settings\MP\Application Data\protect.exe

It drops the following registry entries:

HCKU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell:
C:\Documents and Settings\MP\Application Data\protect.exe


After execution it displays fake threat messages and forces the user to purchase the software in order to remove the fake threats: