W32/FakeAV.0435!tr

Alias/esTrojan.Win32.FraudPack.aohl (KAV)
Release DateMar 09, 2010
Detection Availability
Active DatabaseExtended Database
FortiGatelowhigh
FortiClient
FortiMailN/A
Current Antivirus Definition Database Version: 12.196
Description

Visible Symptoms

  • The following file exists:

      %UserProfile%\Local Settings\Application Data\av.exe

  • It deletes itself from the current directory.

  • Possible firewall alert that an executable program attempts to connect to the Internet.

Detailed Analysis

This detection is for a rogue anti-spyware called Antivirus XP 2010 or XP Internet Security 2010. It imitates scanning the system for malwares and wrongly reports active malware detection. It deceives us to register or purchase the full version because only a registered copy offers a full range of features, including removing the reported malwares.


The malware's behavior is similar to W32/Fakealert.GIJ!tr .
Description Last Updated Date: Mar 16, 2010
Reference: ID - 1633396