Troj/FakeVir-AY pretends to be an anti-spyware program called MalwareBell. It detects clean files on the victim computer as infected with malware, then attempts to scare the user into purchasing "the full version" of MalwareBell.
When run Troj/FakeVir-AY creates the following files:
<Program Files>\MalwareBell\malwarebell.exe - detected as Troj/FakeVir-AY
<Program Files>\MalwareBell\mb.db3 - data file, can be deleted
<Program Files>\MalwareBell\mb.db2 - data file, can be deleted
<Program Files>\MalwareBell\mbuninst.exe - clean; the uninstaller, can be deleted
Troj/FakeVir-AY provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "MalwareBell". The uninstall option fails to remove Troj/FakeVir-AY from the computer.
Troj/FakeVir-AY creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\antispy
<Program Files>\MalwareBell\malwarebell.exe
HKCU\Software\MalwareBell\