Troj/FakeVir-EC is a Trojan for the Windows platform.
Troj/FakeVir-EC includes functionality to access the internet and communicate with a remote server via HTTP.
When Troj/FakeVir-EC is installed the following files are created:
<User>\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
<Desktop>\Antivirus 2009.lnk
<User>\Start Menu\Antivirus 2009\Antivirus 2009.lnk
<User>\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
<System>\scui.cpl
The file scui.cpl is detected as Troj/FakeVir-DE.
Registry entries are set as follows:
HKCU\Software\1118259503360352EE046D861A26B796\Options
pPath
<pathname of the Trojan executable>
HKLM\SOFTWARE\Microsoft\Internet Explorer
UserSession
1118259503360352EE046D861A26B796
Registry entries are created under:
HKCU\Software\1118259503360352EE046D861A26B796\Options