high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2005 (3.94) |
| Protection available since | 25 April 2005 12:44:25 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Fakespy-B runs in the background and every 13 minutes displays a system warning message on the screen informing the user that there is a problem with their computer. If the user clicks "OK" then Troj/Fakespy-B will open Internet Explorer to a web page that sells software to fix the alleged problem.
The Trojan may also display a warning from an icon in the taskbar again informing the user of a problem with the system, and inviting them to click on the icon to get software to fix this problem.
Troj/Fakespy-B does not check the computer for the problems it reports.
Troj/Fakespy-B sets the following registry entry so that, provided it is called helper.exe and it is on the system's path, it will be run every time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
winlogon.exe
msole32.exe
The Trojan also sets the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
CurrentLevel
dword:00011000
|
