Troj/FakeAle-A is a Trojan that may change the Windows wallpaper to an image displaying a fake error message.
The image shows a blue screen and the following text:
Security warning
A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) +
00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c
* System can not function in normal mode.
Please check you security settings.
* Scan your PC with any avaliable antivirus / spyware remover
program to fix the problem.
This image may only be displayed when certain software is installed on the machine.
Troj/FakeAle-A drops the image file as C:\WP.BMP.
Troj/FakeAle-A creates the following registry entry in order to run itself on system startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WindowsFY
<path to Trojan>
Troj/FakeAle-A makes the following further registry changes:
HKCR\CLSID\(145E6FB1-1256-44ED-A336-8BBA43373BE6)
InprocServer32
<path to previous wallpaper>
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoActiveDesktopChanges
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispAppearancePage
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispBackgroundPage
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
Wallpaper
C:\WP.BMP
HKCU\Control Panel\Colors
Background
0 0 0
HKCU\Control Panel\Desktop
Wallpaper
C:\WP.BMP
HKCU\Control Panel\Desktop
WallpaperStyle
0