How to troubleshoot FakeAV if it is not detected

Article:TECH157781  |  Created: 2011-04-11  |  Updated: 2013-01-14  |  Article URL http://www.symantec.com/docs/TECH157781
Article Type
Technical Solution

Product(s)

Languages

Problem



Symptoms:

  • You cannot open Symantec Endpoint Protection (SEP) or any other program.
  • System utilities like Cmd, Taskmgr, and Regedit are disabled.
  • Pop-ups appear from what appears to be an antivirus program other than the one you know to be installed, one which states that there are viruses in the computer and that the computer is infected. Newer variants may also appear to show massive file fragmentation and/or imminent disk failure.

Users may be directed to malicious sites by way of the following methods:

  • Spam emails that contain links or attachments
  • Blogs and forums that are spammed with links to adult videos
  • User-generated content spam, such as fake videos
  • Malicious banner advertisements
  • Sites advertising pornography or pirated software
  • Search Engine Optimization (SEO) poisoning
  • Fake torrent files or files on file sharing networks
  • Web pages containing exploits

 


Cause



FakeAV is a detection for Trojan horse programs that intentionally misrepresent the security status of a computer. These programs attempt to convince the user to purchase software in order to remove non-existent malware or security risks from the computer. The user is continually prompted to pay for the software using a credit card. Some programs employ tactics designed to annoy or disrupt the activities of the user until the software is purchased. It is also referred to as "rogue antivirus".


Solution



  1. Boot the computer in Safe Mode.
  2. Browse to C:\Documents and Settings\%userprofile%\Local Settings\Application Data\
  3. There may be a folder or a .bat file or an .exe with a random name like VRQWSDJFGK. This folder contains the Fake AV file.
  4. If you don't find the folder in above mentioned location, try looking for it in C:\Documents and Settings\All Users\Application Data
  5. Once the folder and file are traced, submit the file to Symantec Security Response using the appropriate entitlement.
  6. Once the file is submitted successfully, the file may be deleted. However, it is not recommended to delete the threat file manually, as it may result in user profile corruption.
  7. Boot the computer in normal mode.
  8. If you are not able to access Internet, correct the proxy settings in Tools > Internet Options > Connections > LAN Settings. Most of the times the Fake AV changes the setting to 'Automatically detect settings'. If there is no proxy server, you may uncheck this setting. 
 
In many cases, the issue gets resolved if the user profile has been deleted and a new user profile is created. This is because these programs are trojans and mostly get installed on the user's profile (on the folders to which the user has access). In some instances where a few users regularly use the same computer, you may only see these programs if the infected user is logged in, but if you switch to another user (with another, non-infected profile), these programs may not be running. However, this is not necessarily the case every time.
 
Symantec Power Eraser

If you are unable to find the suspicious threat file/s, the Symantec Power Eraser is designed to complement mainline antivirus applications by detecting and remediating specific types of threats:

  • New variants of existing threats for which there is no coverage by the current definition sets
  • Fake antivirus applications, and other rogueware
  • Rootkits
  • System settings that have been tampered with maliciously


Please see the following Knowledge Base Article for additional information:


Additional Resources:

 
If you use the Symantec Endpoint Protection Manager to manage SEP clients, consider the following articles:


More Information:
 
Additional articles with excellent information and valuable links to podcasts, blog posts, videos and other resources on the topic.

 

Related Articles



Legacy ID



2010071307124148


Article URL http://www.symantec.com/docs/TECH157781


Terms of use for this information are found in Legal Notices

Please Sign In

Login using SymAccount.

Knowledge Base Search

Knowledge Base Search

Rate this Article

Help us improve your support experience.

MySymantec

MySymantec

Contacting Support

Contacting Support