Home / malware

PDF

Trojan.FakeAv.KYN

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Trojan.FakeAv.KYN is also known as KAV:, Trojan.Win32.FraudPack.atsw.

Explanation :

This trojan tricks the unaware user into thinking that it is a security program; it will trick the user to pay money on it in exchange for cleaning the computer with unexistent viruses.

When executed, the malware will create a copy inside C:Documents and Settings[user name]Local SettingsApplication Data[random-dir-name][random-file-name].exe. The execution will continue from that new location (the original process will terminate). From the new location, new registry values will be added in order to assure that it will be ran during every reboot: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun[random-name] and HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun[random-name]

that will point to its copy inside Application Data directory. The malware will de-activate several (clean) programs installed on the affected machine; The AppInit_DLLs registry value will be deleted, among with registry values pointing to several other programs (clean or not).

Popups alerting the user that he is infected will be displayed, telling that his computer will be disinfected only if he upgrades to the "full version" of the "antivirus" software.

Last update 21 November 2011

 

TOP