Remove Trojan FakeAValert. Removal instructions
Also known as: FakeAValert, TrojanFakeAValert
Severity scale:
 (70 / 100)
The main purpose of Trojan FakeAValert is intimidating people with falsified security alerts. If clicked upon, the alerts recommend downloading rogue security tools and paying for a license. All the programs offered by Trojan FakeAValert are fake, but the alerts loaded by this trojan are very convincing. The pop-ups delivers the following message: “Warning! Potential Spyware Operation Your computer is making unauthorized copies of your system and Internet files. Run full scan now to pervent any unathorised access to your files! Click YES to download spyware remover …” The warning may look like official message loaded by MS Windows, but if you take a closer look, you will find spelling mistakes and lack of logic. Do not trust Trojan FakeAValert and do not purchase applications recommended by this trojan. Related files: system.exe, autorun.exe, printer.exe, WinAvXX.exe Trojan FakeAValert properties: • Shows commercial adverts • Connects itself to the internet • Stays resident in background Trojan FakeAValert snapshot:  Automatic Trojan FakeAValert removal: 
We are testing STOPzilla's efficiency at removing Trojan FakeAValert
(2008-11-12 08:59:52)
We are testing Malwarebytes Anti Malware's efficiency at removing Trojan FakeAValert
(2008-11-12 08:59:52)
We are testing Spyware Doctor's efficiency at removing Trojan FakeAValert
(2008-11-12 08:59:52)
Trojan FakeAValert manual removal:Kill processes:system.exe autorun.exe printer.exe WinAvXX.exe Delete registry values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\??WinAVX?? = ??%System%\WinAvXX.exe?? HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\??WinAVX?? = ??%System%\WinAvXX.exe?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\??Shell?? = ??Explorer.exe?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\??Shell?? = ??Explorer.exe %System%\printer.exe?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??1200? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??1201? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??1208? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??1608? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??1804? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0\??2500? = ??3? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??1200? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??1201? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??1208? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??1608? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??1804? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1\??2500? = ??3? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??1200? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??1201? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??1208? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??1608? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??1804? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2\??2500? = ??3? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??1200? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??1201? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??1208? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??1608? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??1804? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3\??2500? = ??3? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??1200? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??1201? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??1208? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??1608? = ??0? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??1804? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\4\??2500? = ??3? HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\??Enable Browser Extensions?? = ??yes?? HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Windir%\system32\??winav.exe?? = ??%Windir%\system32\winav.exe:*:Enabled:@xpsp2res.dll,-22019? HKEY_CLASSES_ROOT\.htm\??(Default Value)?? = ??htmlfile?? HKEY_CLASSES_ROOT\.html\??(Default Value)?? = ??htmlfile?? HKEY_CLASSES_ROOT\.shtml\??(Default Value)?? = ??htmlfile?? HKEY_CLASSES_ROOT\.xht\??(Default Value)?? = ??htmlfile?? HKEY_CLASSES_ROOT\.xhtml\??(Default Value)?? = ??htmlfile?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\??EnableBalloonTips?? = ??1? HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\??EnableBalloonTips?? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\??DisableTaskMgr?? = ??1? HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\??DisableTaskMgr?? = ??1? HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\??NoControlPanel?? = ??1? HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\??NoControlPanel?? = ??1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\??DisableRegistryTools?? = ??1? HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\??DisableRegistryTools?? = ??1? HKEY_CURRENT_USER\Software\Policies\Microsoft\windows\Windows Update\??NoAutoUpdate?? = ??1? HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\??NoAutoUpdate?? = ??1? HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\??NoWindowsUpdate?? = ??1? HKEY_CLASSES_ROOT\gopher\shell\open\command\:??"C:\Program Files\Internet Explorer\??iexplore.exe?? = ??-nohome?? HKEY_CLASSES_ROOT\gopher\shell\open\command\: ????C:\Program Files\Internet Explorer\??iexplore.exe?? = ??%1? HKEY_CLASSES_ROOT\HTTP\shell\open\command\: ????C:\Program Files\Internet Explorer\??iexplore.exe?? = ??-nohome?? HKEY_CLASSES_ROOT\HTTP\shell\open\command\: ????C:\Program Files\Internet Explorer\??iexplore.exe?? = ??%1? HKEY_CLASSES_ROOT\https\shell\open\command\: ????C:\Program Files\Internet Explorer\??iexplore.exe?? = ??-nohome?? HKEY_CLASSES_ROOT\https\shell\open\command\: ????C:\Program Files\Internet Explorer\??iexplore.exe?? = ??%1? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Default_Search_URL?? = ??http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Default_Search_URL?? = ??http://www.google.com/ie?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Search Page?? = ??http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Search Page?? = ??http://www.google.com?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Start Page?? = ??http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home?? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\??Start Page?? = ??http://www.google.com?? HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\??Start Page?? = ??http://www.google.com/?? HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\??Start Page?? = ??http://www.google.com?? HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\??Search Page?? = ??http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch?? HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\??Search Page?? = ??http://www.google.com?? Delete files: UserProfile\\Start Menu\\Programs\\Startup\\system.exe C:\\Documents and Settings\\All Users\\ Start Menu\\Programs\\Startup\\autorun.exe System\\printer.exe System\\WinAvXX.exe 
Information added: 2008-11-12 06:19:27
Information updated: 2008-11-12 06:22:37 Additional resources related to Trojan FakeAValert:Attention: If you know or you have a website or page about Trojan FakeAValert removal, feel free to add a link to this list: add url |
Latest spyware news:
Subscribe to news
Similar parasites:
|
FORUM:
HELP:
Spreading the knowledge:
It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your
visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.
Post Comment: