Troj/FakeAle-D

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry for each user who ran the virus. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export Range' panel, click 'All', then save your registry as Backup.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
WindowsFY
<Root>\wp.exe

and delete it if it exists.

Close the registry editor.

Troj/FakeAle-D is a Windows Trojan.

Troj/FakeAle-D includes functionality to change browser settings and display a fake message as your Windows Desktop background image.

The image shows a blue screen and the following text:

Security warning

A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) +
00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

* System can not function in normal mode.
Please check you security settings.
* Scan your PC with any avaliable antivirus / spyware remover
program to fix the problem.

When Troj/FakeAle-D is installed the following files are created:

<System>\wldr.dll
<Root>\wp.bmp
<Root>\wp.exe

The file wp.exe is detected as Troj/FakeAle-A. These files may be deleted. Troj/FakeAle-D is a Windows Trojan.

Troj/FakeAle-D includes functionality to change browser settings and display a fake message as your Windows Desktop background image.

The image shows a blue screen and the following text:

Security warning

A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) +
00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

* System can not function in normal mode.
Please check you security settings.
* Scan your PC with any avaliable antivirus / spyware remover
program to fix the problem.

When Troj/FakeAle-D is installed the following files are created:

<System>\wldr.dll
<Root>\wp.bmp
<Root>\wp.exe

The file wp.exe is detected as Troj/FakeAle-A. These files may be deleted.

The following registry entry is created to run wp.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WindowsFY
<Root>\wp.exe

The file wldr.dll is registered as a COM object and plugin, creating registry entries under:

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ButtonText
Microsoft AntiSpyware helper

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
Default Visible
No

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
HotIcon
Shell32.dll,128

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
MenuStatusBar
Shell32.dll,241

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
MenuText
Microsoft AntiSpyware helper

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ToolTip
Microsoft AntiSpyware helper

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ImageFilename
Shell32.dll

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
clsid
(random ClassID1)

HKCU\Software\Microsoft\Internet Explorer\Extensions\(random ClassID1)
BandCLSID
(random ClassID2)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
clsid
(random ClassID1)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
BandCLSID
(random ClassID2)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ButtonText
Microsoft AntiSpyware helper

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
Default Visible
No

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
HotIcon
Shell32.dll,128

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
MenuStatusBar
Shell32.dll,241

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
MenuText
Microsoft AntiSpyware helper

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ToolTip
Microsoft AntiSpyware helper

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\(random ClassID1)
ImageFilename
(random ClassID4)

HKCR\CLSID\(random ClassID1)\InprocServer32
(default)
<System>\wldr.dll

Registry entries are set as follows:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoActiveDesktopChanges
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
WallpaperStyle
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispBackgroundPage
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispAppearancePage
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
Wallpaper
<Root>\wp.bmp

HKCU\Control Panel\Desktop
Wallpaper
<Root>\wp.bmp

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components
GeneralFlags
0

HKCU\Control Panel\Colors
Background
0 0 0

HKCU\Control Panel\Desktop
Wallpaper
<Root>\wp.bmp

HKCU\Control Panel\Desktop
WallpaperStyle
0

Troj/FakeAle-D also changes the following sections in <Windows>\win.ini:

[Colors]
Background = 0 0 0

[DeskTop]
Wallpaper=<Root>\wp.bmp
WallpaperStyle=2