Alert level

Trojan:Win32/WinSpywareProtect


Encyclopedia entry
Updated: Apr 21, 2009  |  Published: Jun 07, 2008

Aliases
  • Win32/Adware.WinSpywareProtect (ESET)
  • Trojan-Downloader.Win32.FraudLoad.aob (Kaspersky)
  • WinSpywareProtect (Symantec)
  • Program:Win32/WinSpywareProtect (other)
  • Trojan.FakeAV.GP (BitDefender)
  • Win32/Adware.MSAntispyware2009 (ESET)
  • Packed.Win32.Katusha.a (Kaspersky)
  • FaleAlert-BV (McAfee)
  • Adware/MSAntiSpyware2009 (Panda)
  • Fraudtool.MSAntispy2009.A (VirusBuster)
  • MS Antispyware 2009 (other)
  • AV Antispyware (other)
  • Extra Antivirus (other)

Alert Level (?)
High

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection last updated:
Definition: 1.71.269.0
Released: Nov 26, 2009 		Detection initially created:
Definition: 1.45.287.0
Released: Oct 07, 2008

Summary

Trojan:Win32/WinSpywareProtect is a program that may falsely claim that the user's system is infected and encourages the user to buy a promoted product for cleaning the alleged malware from the computer.

Top

Symptoms

System Changes
The following system changes may indicate the presence of Trojan:Win32/WinSpywareProtect:
  • The presence of the following file folders:
    %ProgramFiles%\burstwriting
    %ProgramFiles%\winspywareprotect
    %APPDATA%\adsl software limited
    %USERPROFILE%\Start Menu%\Programs\winspywareprotect
  • The presence of the following file:
    %ProgramFiles%\winspywareprotect\winspywareprotect.exe
  • Presence of the following registry value and data:
    Value: "InstallProgram"
    With data: "%ProgramFiles%\winspywareprotect\winspywareprotect.exe"
    In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Top

Technical Information (Analysis)

Trojan:Win32/WinSpywareProtect is a program that may falsely claim that the user's system is infected and encourages the user to buy a promoted product for cleaning the alleged malware from the computer.
Installation
Win32/WinSpywareProtect may be installed from the program's web site or by social engineering from third party web sites. The installer may make the following system changes:
 
  • Creates the following folders:
    %ProgramFiles%\burstwriting
    %ProgramFiles%\winspywareprotect
    %APPDATA%\adsl software limited
    %USERPROFILE%\Start Menu%\Programs\winspywareprotect
 
  • Drops the following files:
    %ProgramFiles%\winspywareprotect\winspywareprotect.exe
    %TEMP%\_addon.exe
 
The registry may be modified to execute Win32/WinSpywareProtect at each Windows start.
 
Adds value: "InstallProgram"
With data: "%ProgramFiles%\winspywareprotect\winspywareprotect.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 
The following registry modifications may also be made during installation:
 
Adds value: "InstallDate"
With data: "¦..&"
To subkey: HKCU\Software\Adsl Software Limited\Installer
 
Adds value: "4E8D9EBF-122C-42BD-A8CB-7E59C9CC08BA"
With data: "0"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Drivers\Video\Options\
 
Adds value: "lid"
With data: "-1"
To subkey: HKCU\SOFTWARE\Adsl Software Limited\WinSpywareProtect\
 
Analysis by Subratam Biswas

Top

Prevention

Follow these general security tips to better protect your system:
  • Enable a firewall on your computer.
  • Get the latest computer updates.
  • Run an up-to-date scanning and removal tool.
  • Use caution with attachments and file transfers.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Network and Internet Connections. If you do not see Network and Internet Connections, click Switch to Category View.
  3. Click Change Windows Firewall Settings.
  4. Select On.
  5. Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Performance and Maintenance. If you do not see Performance and Maintenance, click Switch to Category View.
  3. Click System.
  4. Click Automatic Updates.
  5. Select a setting. Microsoft recommends selecting Automatic. If you do not choose Automatic, but you choose to be notified when updates are ready, a notification balloon appears when new downloads are available to install. Click the notification balloon to review and install the updates.
Run an up-to-date scanning and removal tool
Most scanning and removal software can detect and prevent the installation of known malicious software and potentially unwanted software such as adware or spyware. You should frequently run a scanning and removal tool that is updated with the latest signature files. For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.
Use caution with attachments and file transfers
Exercise caution with e-mail and attachments received from unknown sources, or received unexpectedly from known sources.  Use extreme caution when accepting file transfers from known or unknown sources.

Top

Recovery

Trojan:Win32/WinSpywareProtect may place an uninstaller entry in "Add or Remove Programs" in Control Panel. The entry name may be called "WinSpyware Protect" or similar. If an uninstaller is not available or if you do not want to use the uninstaller that is provided, use Microsoft Windows Defender or another up-to-date scanning and removal tool to detect and remove Win32/WinSpywareProtect and other potentially unwanted software from your computer. For more information, see http://www.microsoft.com/protect/products/computer/default.mspx.

Top