How to Detect and Rmove the Trojan.FakeAV

Share:[removed][removed][removed]1.%20What%20is%20the%20Trojan.FakeAVTrojan.FakeAV%20is%20a%20malicious%20trojan%20horse%20that%20may%20represent%20a%20high%20security%20risk%20for%20the%20compromised%20system%20or%20its%20network%20environment.%20Trojan.FakeAV,%20also%20known%20as%20Trojan.Win32.Small.ccz,%20creates%20a%20startup%20registry%20entry%20and%20may%20display%20annoying%20fake%20alerts%20of%20malware%20payloads%20in..." target="_self" >

[removed]// var addthis_config = {"data_track_clickback":true};

// ]]>[removed]

[removed][removed]

1. What is the Trojan.FakeAV

Trojan.FakeAV is a malicious trojan horse that may represent a high security risk for the compromised system or its network environment. Trojan.FakeAV, also known as Trojan.Win32.Small.ccz, creates a startup registry entry and may display annoying fake alerts of malware payloads in order to persuade users to buy rogue antispyware products. Trojan.FakeAV contains characteristics of an identified security risk and should be removed once detected.

a. File System Modifications

%CommonFavorites%\_favdata.dat

%Temp%eapp32hst.dll

%Temp%PRAGMAb224.tmp

%Temp%PRAGMAb253.tmp

%Temp%PRAGMAc84c.tmp

%Temp%TMP43307.tmp

%Temp%opwesitjh

%Temp%wscsvc32.exe

%Windir%PRAGMAsesmccxtirPRAGMAc.dll

%Windir%PRAGMAsesmccxtirPRAGMAcfg.ini

%Windir%PRAGMAsesmccxtirPRAGMAd.sys

%Windir%PRAGMAsesmccxtirPRAGMAsrcr.dat

Notes: %CommonFavorites% is a variable that refers to the file system directory that serves as a common repository for all users' favorite items. A typical path is C:Documents and SettingsAll UsersFavorites (Windows NT/2000/XP).

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:Documents and Settings[UserName]Local SettingsTemp (Windows NT/2000/XP).

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:Windows or C:Winnt.

The following directory was created: %Windir%PRAGMAsesmccxtir

.

b. Memory Modifications

There were new processes created in the system:

Process Name

Process Filename

Main Module Size

wscsvc32.exe

%Temp%wscsvc32.exe

314,368 bytes

c. Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINESOFTWAREProgram Groups

HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR

HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR000

HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR000Control

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR000

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR000Control

HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerMainfeaturecontrol

HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerMainfeaturecontrolfeature_enable_ie_compression

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

HKEY_LOCAL_MACHINESOFTWAREPRAGMA

HKEY_LOCAL_MACHINESOFTWAREPRAGMAversions

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesPRAGMAsesmccxtir

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesPRAGMAsesmccxtirmodules

The newly created Registry Values are:

[HKEY_LOCAL_MACHINESOFTWARE] f7c5da73-b4a5-4947-8f40-08f2871eb36b = ""

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciessystem] DisableTaskMgr = 0x00000001

[HKEY_LOCAL_MACHINESOFTWAREProgram Groups] ConvertedToLinks = 0x00000001

[HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR000Control] *NewlyCreated* = 0x00000000

ActiveService = "PRAGMAsesmccxtir"

[HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR000] Service = "PRAGMAsesmccxtir"

Legacy = 0x00000001

ConfigFlags = 0x00000000

Class = "LegacyDriver"

ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"

DeviceDesc = "PRAGMAsesmccxtir"

[HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_PRAGMASESMCCXTIR] NextInstance = 0x00000001

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR000Control] *NewlyCreated* = 0x00000000

ActiveService = "PRAGMAsesmccxtir"

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR000] Service = "PRAGMAsesmccxtir"

Legacy = 0x00000001

ConfigFlags = 0x00000000

Class = "LegacyDriver"

ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"

DeviceDesc = "PRAGMAsesmccxtir"

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_PRAGMASESMCCXTIR] NextInstance = 0x00000001

[HKEY_USERS.DEFAULTSoftwareMicrosoftInternet ExplorerMainfeaturecontrolfeature_enable_ie_compression] svchost.exe = 0x00000001

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings] ProxyEnable = 0x00000000

[HKEY_CURRENT_USERPrintersConnections] affid = "396"

subid = "landing"

[HKEY_CURRENT_USERSoftware] 24d1ca9a-a864-4f7b-86fe-495eb56529d8 = ""

7bde84a2-f58f-46ec-9eac-f1f90fead080 = ""

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem] DisableTaskMgr = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] dfrgsnapnt.exe = "%Temp%dfrgsnapnt.exe"

[HKEY_LOCAL_MACHINESOFTWAREPRAGMA] affid = "5"

type = "no"

build = "no"

subid = "direct"

[HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesPRAGMAsesmccxtirmodules] PRAGMAd = "systemrootPRAGMAsesmccxtirPRAGMAd.sys"

PRAGMAc = "systemrootPRAGMAsesmccxtirPRAGMAc.dll"

[HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesPRAGMAsesmccxtir] start = 0x00000001

type = 0x00000001

imagepath = "systemrootPRAGMAsesmccxtirPRAGMAd.sys"

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlServiceCurrent] (Default) =

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlServiceCurrent] (Default) =

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders] Cache =

d. Other details

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host

Port Number

91.212.127.86

80

91.212.127.96

80

The data identified by the following URL was then requested from the remote web server:

http://mediafulluns.com/any3/5-direct.ex

http://www.searchaverage.org/a/ad

http://searchaverage.org/readdatagateway.php?type=stats&affid=396&subid=landing&version=4.0&adwareok

2. How-to's

a. Please updatethe policy basic knowledge of Sax2 in time, Once sax2 detects the communication of these trojans, it will break them and ensure your network & business security.

b. How to Remove the Trojan.FakeAV Manually?

Step 1 : The associated files of Trojan.FakeAV to be deleted are listed below:

[HKEY_LOCAL_MACHINESOFTWAREClasses*]

Step 2 : The registry entries of Trojan.FakeAV that need to be removed are listed as follows:

File NameFile SizeMD5

CLADD

2560

e229a2fa3acd3f307ede63b89db833a4

WI3e94.exe

1943552

02fed38ea8975716f5f8f2595f905010

ddexpshare.exe

790528

8b4840953e5511d0a08ee67ff0034e2c

services.exe

47616

da9976cd71469bbcf0f87ec40e2ce798

c. How to Remove these trojans Instantly?

Malwarebytes' Anti-Malware is an anti-malware application that can thoroughly remove even the most advanced malware. It includes a number of features, including a built in protection monitor that blocks malicious processes before they even start. visit http://www.ids-sax2.com/Malwarebytes-Anti-Malware.htm and download Malwarebytes' Anti-Malware to help you.

3. Appendix

For more information, please visit http://www.ids-sax2.com/ComputerSecurityNewsletter.htm

How to Detect and Rmove the Trojan.FakeAV

By: andy.J

POST COMMENT

Thoroughly Uninstall and Remove The Fake Security Program- Antivirus IS Easily Get Rid of the Fake Anti-virus Software- Iron Defense How to Remove AV Antivirus Suite - Get Rid of This Fake Spyware Easily How to spot fake SEO specialists in Singapore Get Rid of Microsoft Security Essentials Alert a Fake Trojan Installing Fake Antivirus programs like Red Cross Antivirus, Peak Protection 2010 How to Get Rid of Antimalware Doctor Antivirus? Eliminate and Remove Antimalware Doctor Antivirus Fake Antivirus Completely How to remove Antimalware How to Get Rid of Security Master AV Antivirus? Eliminate Security Master AV Antivirus Fake Antivirus Completely How to remove Security Master AV? How to Get Rid of ShieldSoldier Antivirus? Eliminate and Remove ShieldSoldier Antivirus Fake Antivirus Completely How to remove ShieldSoldier? Diagnose and Remove User Account Control (Fake) Watch out The Fake Products May Ruin Your Vacation Remove Microsoft Security Essentials (Fake) – Guides to Remove Microsoft Security Essentials (Fake) Average Human Penis Size How To Spot A Fake Orgasm - 7 Mind Blowing Ways To Spot A Fake Orgasm Anytime How to Get Rid of TrustDefender Antivirus? Eliminate and Remove TrustDefender Antivirus Completely? How to remove TrustDefender fake Antivirus?