|Typical Symptoms||Create Desktop icons,System speed down,System Error,Download Malicious code,Auto-execution on rebooting,Intercept Install/Operation,POP-UP Window,Install fake Anti-Virus|
|Discovered|| [korea] 2010-05-18
|Target of infection||E-mail,Download by Malicious code,Execution|
|Scan engine needed||
2010-05-18 [Able to detect & repair]
[Symptom of Infection]
[Spyware.FakeAV.Dr.389120] is a fake Anti-Spyware that induces users to purchase for fake repair by showing fake detection result.
[PIC 1] Fake Anti-Spyware name is "Data Protection".
[PIC 2] Fake Anti-Spyware UI
[PIC 3] Interrupting normal programs execution
[PIC 4] A fake warning window of "KeyLogger detected on your PC"
[PIC 5] A fake warning window of "Network attack detected"
[PIC 6] Making users to feel nervous by ending Windows forcibly
[PIC 7] Fake detection result
[PIC 8] Installation
[PIC 9] Inducing to purchase fake Anti-Spyware
[PIC 10] Fake attack detection warning by using cookie values
[PIC 11] Showing Windows Security Center pretended malicious code
[PIC 12] Fake file and URL link that created by malicious code
[PIC 13] Fake warning message
[Spyware.FakeAV.Dr.389120] accessed URL and IP are like below:
[Spyware.FakeAV.Dr.389120] creates below files:
[Spyware.FakeAV.Dr.389120] creates below registries:
[How to repair]
1. If you are WinXP/ME users, please be inactivate System Recovery Function.