Multi-Device Licenses (Volume Discounts)
Threat Database Fake Error Messages Warning! Trojan Found! Popup

Warning! Trojan Found! Popup

By GoldSparrow in Fake Error Messages
Translate To:
English

The 'Warning! Trojan Found' Popup is a fake warning alert generated and promoted by the rogue anti-spyware application Extra Antivirus. The fake pop-up alert text reads:

"Your computer is infected. Warning!Trojan Found! Threat detected: Trojan. File name: svhost.sys. Threat name: Trojan-PSW.BAT.Cunter. File at risk of infection: C:\Documents and Settings\. Total vulnerabilities: 21. Description: This trojan is trying to steal all your passwords for network. Recommended: Please click ‘Remove All’ to eliminate all possible threats and protect your PC."

The 'Warning!Trojan Found' Popup attempts to mislead the user into believing that their PC is infected so that the user will buy the rogue Extra Antivirus program. There is no infection; the alert is fake. The user should not trust the 'Warning!Trojan Found' Popup and should remove the infection without hesitation.

File System Details

Warning! Trojan Found! Popup may create the following file(s):
Expand All | Collapse All
# File Name Detections
1. c:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\delfile.sys
2. c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\energy.exe
3. c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\CLSV.dll
4. c:\WINDOWS\ime\exec.dll
5. c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\energy.exe
6. c:\WINDOWS\Installer\$PatchCache$\Managed\D6461317C3DC4F04799BDCE9E42626FE\2.0.50727\ANTIGEN.sys
7. c:\WINDOWS\ServicePackFiles\i386\ppal.dll
8. c:\WINDOWS\system32\tjd.exe
9. C:\Documents and Settings\\Application Data\7c69f0c\UA2009.exe
10. c:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\ANTIGEN.sys
11. c:\WINDOWS\ServicePackFiles\i386\SICKBOY.exe
12. c:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\CLSV.dll
13. %UserProfile%\Application Data\Ultra Antivir2009\Instructions.ini
14. %UserProfile%\Start Menu\Ultra Antivir2009.lnk
15. C:\Documents and Settings\\Application Data\7c69f0c\SystemStore\vd952342.bd
16. c:\WINDOWS\std.drv
17. c:\WINDOWS\ServicePackFiles\i386\ppal.tmp
18. %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Ultra Antivir2009.lnk
19. %UserProfile%\Start Menu\Programs\Ultra Antivir2009.lnk
20. C:\Documents and Settings\\Application Data\7c69f0c\SystemStore
21. C:\Documents and Settings\\Application Data\SystemStore\uavir.cfg
22. c:\WINDOWS\ime\snl2w.drv
23. %UserProfile%\Application Data\Ultra Antivir2009
24. %UserProfile%\Desktop\Ultra Antivir2009.lnk
25. C:\Documents and Settings\\Application Data\7c69f0c
26. C:\Documents and Settings\\Application Data\SystemStore
27. c:\WINDOWS\$hf_mig$\KB947864-IE7\update\kernel32.tmp
28. c:\WINDOWS\ServicePackFiles\i386\snl2w.drv

Registry Details

Warning! Trojan Found! Popup may create the following registry entry or registry entries:
HKEY..\..\..\..{RegistryKeys}
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\CLSID\{425882B0-B0BF-11CE-B59F-00AA006CB37D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "4800156103"
HKEY_CLASSES_ROOT\UA2009.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Ultra Antivir2009"

Trending

Most Viewed

Loading...