Malwarebytes Blog

Trojan.FakeAlert is a trojan which installs via fake codecs or browser exploits. Once installed it delivers popup advertisements for useless products. These symptoms will be accompanied by the installation of a rogue application with no user prompts or action required. Trojan.FakeAlert has been updated and now installs the following directory.

C:\Program Files\PCHealthCenter

We have provided removal instructions for anybody unfortunate to have been infected by this trojan.

Removal instructions for Trojan.FakeAlert

New Zlob has been released again. It installs the following files, folders and registry entries.

C:\Windows\System32\214075
C:\Windows\System32\funfsnv.dll
C:\Program Files\Web Technologies

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{99f8405b-63d1-421a-83bb-7b4b0642ac28} = eulogical

We have provided removal instructions for anybody unfortunate to have been infected by this trojan.

Removal instructions for Trojan.Zlob

A new rogue, AntiSpyCheck, has been released. It is advertised by a trojan.

If you have seen any of the windows above on your computer, it is recommended that you follow these instructions. We have provided removal instructions for anybody unfortunate to have downloaded these applications.

Removal instructions for AntiSpyCheck

Marcin Kleczynski

New Zlob has been released again. It installs the following files and registry entries.

C:\Windows\System32\kfcpnd.dll

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{5c7b71bb-6d49-4bdc-b60d-f9fe0481eb5f} = campaniform

We have provided removal instructions for anybody unfortunate to have been infected by this trojan.

Removal instructions for Trojan.Zlob

Another new rogue application has been discovered.

If you have seen any of the windows above on your computer, it is recommended that you follow these instructions. We have provided removal instructions for anybody unfortunate to have downloaded this application.

Removal instructions for MalwarePatrolPro

Marcin Kleczynski

A new rogue has been discovered.

If you have seen any of the windows above on your computer, it is recommended that you follow these instructions. We have provided removal instructions for anybody unfortunate to have downloaded this application.

Removal instructions for PCPrivacyCleaner

Marcin Kleczynski

A new rogue, AdvancedXPFixer, part of the iSecurity group has been released. It is advertised by a trojan.

If you have seen any of the windows above on your computer, it is recommended that you follow these instructions. We have provided removal instructions for anybody unfortunate to have downloaded these applications.

Removal instructions for AdvancedXPFixer

Marcin Kleczynski

Details of two new rogues, Advanced XP Defender and XP SecurityCenter, below.

If you have seen any of the windows above on your computer, it is recommended that you follow these instructions. We have provided removal instructions for anybody unfortunate to have downloaded these applications.

Removal instructions for Advanced XP Defender
Removal instructions for XP SecurityCenter

Marcin Kleczynski

VideoAccessCodec has been updated. The codec installs the following files.

C:\Windows\pxgdslro.dll
C:\Windows\mdtgkswr.exe
C:\Windows\gnowmebk.dll
C:\Windows\gktxaspm.dll
C:\Windows\eova.exe

We have provided removal instructions for anybody unfortunate to have been infected by this codec.

Removal instructions for VideoAccessCodec

VideoAccessCodec has been updated. The codec installs the following files.

C:\Windows\vbksrofa.dll
C:\Windows\pvnsmfor.dll
C:\Windows\oadkxrts.exe
C:\Windows\mpfanvqg.dll

We have provided removal instructions for anybody unfortunate to have been infected by this codec.

Removal instructions for VideoAccessCodec