WindowsScan
WindowsScan
Found:
2011-01-24
Description:
Win32.FraudTool.WindowsScan is a rogue anti-spyware application. It may give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.
Credit: Tachikoma
Known system changes:
Files
%Desktop%\Windows Scan.lnk
Folders
RegistryEntries
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: CL0xxjPW0vI
Data: C:\Documents and Settings\All Users\Application Data\CL0xxjPW0vI.exe
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: RhESDHhktGyi.exe
Data: C:\Documents and Settings\All Users\Application Data\RhESDHhktGyi.exe