Threat description search results - Microsoft Security Intelligence

Rogue:Win32/FakeSmoke

Updated on Apr 11, 2011

Win32/FakeSmoke is a family of trojans consisting of a fake Security Center interface and a fake antivirus program. The fake Security Center interface displays fake security notifications in the system and is designed to look identical to the legitimate Windows Security Center. It prompts the user to register the fake antivirus program.

The fake antivirus program may be known by several names, including WinBlueSoft and WiniBlueSoft. This program pretends to scan for malware infections and then displays a fake notification that malware has been detected in the system. It then prompts the user to enter a registration code, which is available only if the user purchases the fake product.

Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late. These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs, such as Win32/Antivirusxp and Win32/FakeRednefed may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.

To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Alert level: severe