دیسنا : خبرنامه تخصصی آنتی ویروس ها

1. Download TSC_FakeAV24.zip from this link then save it to your Desktop.

ftp://us-web%5Ccustomer@ftp.trendmicro.com/rom/TSC_FakeAV24.zip

2. Right-click TSC_FakeAV24.zip then click Extract all.

3. Open TSC_FakeAV24 folder

4. Open TSC folder

5. Run tsc.exe

You might have issues opening exe files after removing the virus.  To fix it

1. Download regfix_IE-exe-file_association.zip from this link then save it to your Desktop.

ftp://us-web%5Ccustomer@ftp.trendmicro.com/rom/regfix_IE-exe-file_association.zip

2. Right-click regfix_IE-exe-file_association.zip then click Extract all.

3. Open regfix_IE-exe-file_association folder

4. Run the VBScript regfix_IE-exe-file_association.vbs to fix the registry entries added by the malware

How to remove XP/Vista/7 Antispyware 2010 infection

*Please download the attached file before performing the following instructions.
Save the attached file and rename it to regfix_IE-exe-file_association.vbs instead of regfix_IE-exe-file_association.txt

1. Run HijackThis and save a log file.
http://esupport.trendmicro.com/Pages/How-to-generate-Trend-Micro-HiJackThis-logs-for-malware-analysi...

2. Check the log file and look for an entry on the running processes with AV.exe on it and copy it.
ex:
C:\Documents and Settings\Calvin\Local Settings\Application Data\av.exe

3. Download and run Twin-Fix by following the instructions here:

http://esupport.trendmicro.com/Pages/How-does-the-Twin-Fix-tool-work-and-how-is-it-used.aspx

On Virus.txt, paste the Hijackthis entry with AV.exe.

4. After Running Twin-Fix, run regfix_IE-exe-file_association.vbs to restore the modified registry values by this Fake AV

What's annoying with this FakeAV is it has a lot of variants and more are coming out everyday.  Trend Micro already has a detection for most of the variants of this Fake AV. TROJ_KRAP.SMER was added on the pattern yesterday to detect most of the AV.exe variants. Make sure your Trend Micro is updated and you’ll be protected from this Fake AV.