arrow_back
search
close

HTML_FAKEAV.BBL

October 09, 2012
 Analysis by: MarfelTi
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan displays fake alerts that may trick the user into downloading more malicious files onto the affected system or reveal confidential information that could be sent to malicious users and compromises their financial accounts.

It installs rogue applications on the affected system.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It executes when a user accesses certain websites where it is hosted. It may be hosted on a website and run when a user accesses the said website.

It installs a fake antivirus/antispyware software.

  TECHNICAL DETAILS

File Size:

11,623 bytes

File Type:

HTML, HTM

Memory Resident:

Yes

Initial Samples Received Date:

04 May 2011

Payload:

Displays message/message boxes

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It executes when a user accesses certain websites where it is hosted.

It may be hosted on a website and run when a user accesses the said website.

Other Details

This Trojan requires the following additional components to properly run:

  • warning.jpg
  • warning2.jpg

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

  • Dont close this window if your want you PC to be clean.
  • Harmful and malicious software detected. These programs may damage your computer and steal your private information. Online Security Scanner requires Antivirus 2009 components to repair your computer. Please click OK to download and install Antivirus 2009 components.
  • ATTENTION! You have not completed the virus scan! Your PC is still infected with spyware! Please return to antivirus-2009.com and download Antivirus 2009 scanner.

It installs a fake antivirus/antispyware software.

  SOLUTION

Minimum Scan Engine:

8.900

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Close all opened browser windows

Step 3

Scan your computer with your Trend Micro product to delete files detected as HTML_FAKEAV.BBL. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.