Troj/Fakespy-B runs in the background and every 13 minutes displays a system warning message on the screen informing the user that there is a problem with their computer. If the user clicks "OK" then Troj/Fakespy-B will open Internet Explorer to a web page that sells software to fix the alleged problem.
The Trojan may also display a warning from an icon in the taskbar again informing the user of a problem with the system, and inviting them to click on the icon to get software to fix this problem.
Troj/Fakespy-B does not check the computer for the problems it reports.
Troj/Fakespy-B sets the following registry entry so that, provided it is called helper.exe and it is on the system's path, it will be run every time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
winlogon.exe
msole32.exe
The Trojan also sets the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
CurrentLevel
dword:00011000