Worm:Win32/Virauto.A is a worm that propagates by copying itself to drives in the system. It may also add its copy to archived ZIP files in the system. It has backdoor capabilities and may also download other files. It modifies the HOSTS file to prevent the system from downloading antivirus updates.

Win32/Pameseg is a family of installers that require the user to send an SMS message to a premium number to successfully install certain programs, some of which are otherwise be available for free. Currently, most variants target Russian speakers.

For more information on Pameseg, please see the following blog posts:

• Easy Money: Program:Win32/Pameseg (part one)
• Easy Money: Program:Win32/Pameseg (part two)
• Fake apps: Behind the effective social strategy of fraudulent paid-archives

Windows Defender Antivirus detects and removes this threat. 

This family of programs claim to scan for hardware defects related to system memory, hard drives and over-all system performance. They show fake hardware problems and ask you to pay money to repair them.

Windows Defender detects and removes this threat.

Win32/FakeSysdef is a family of programs that claim to scan for hardware defects related to system memory, hard drives and over-all system performance. They scan the system, show fake hardware problems, and offer a solution to defrag the hard drives and optimize the system performance. They then inform the user that they need to pay money to download the fix module and to register the software in order to repair these non-existent hardware problems. One of the first variants was distributed as program named "HDD Defragmenter" hence the name "FakeSysdef" or "Fake System Defragmenter".

NOTE: On March 31, 2017, an incorrect detection for our cloud-based protection for Trojan:Win32/FakeSysdef was identified and immediately fixed.

To ensure that this issue is remediated, you can do a forced daily update to download your Microsoft antimalware and antispyware software. The fix has been deployed in signature build 1.239.530.0 on March 31, 2017, 2:50 PM PDT.

See Updating your Microsoft antimalware and antispyware software for more information.