print version

Conflicker.b Spam Trojan

Conflicker.b Spam Trojan

"Your computer is infected."  These words make rogue antivirus programs particularly effective.  We all want to protect our computers, and when we see that there are threats, we often act quickly.  However, this can invite more issues into our systems.  Trojans, such as the Conflicker.b spam Trojan, use our desire to protect our computers in order to install itself and other forms of malware into our systems.

What is the Conflicker.b Spam Trojan?

Conflicker.b is a Trojan that is associated with the rogue antivirus program Antivirus Pro 2010.  The Trojan is found on affected emails; the purpose of the emails is to persuade computers users that there are security threats to their systems that they need to resolve immediately.  You are urged:

Please install attached file to start the [security] scan.  The process takes under a minute and will prevent your files from being compromised.  We appreciate your prompt cooperation.

The message appears to have come from Microsoft, so many people do install the file.  Instead of protection, however, they will be getting a rogue antivirus program.  Antivirus Pro 2010 then installs itself and beings to affect your computer's performance.

Where Does Conflicker.b Spam Trojan Come From?

Conflicker.b is a Trojan that is hidden in email attachments that appear to come from Microsoft.  Remember that they do not.  The email reads as follows:

Subject:  Conflicker.B Infection Alert

Message: 

Dear Microsoft Customer,

Starting 18/10/2009 the "Conflicker" worm began infecting Microsoft customers unusually rapidly.  Microsoft has been advised by your Internet provider that your network is infected.

To counteract further spread we advise removing the infection using an antispyware program.  We are supplying all effected [sic] Windows Users with a free system scan in order to clean any files infected by the virus.

Please install the attached file to start scan.  The process takes under a minute and will prevent your files from being compromised.  We appreciate your prompt cooperation.

Regards,

Microsoft Windows Agent #2 (Hollis)

Microsoft Windows Computer Safety Division

If the user opts to run the scan and opens the zip file, the Conflicker.b Trojan gains access to your system.

How do you know that this is a false message?  First, Microsoft does not have your email address.  Second, they will not send a message like this.  They update security via the Automatic Update system, so you know that this message could never have come from Microsoft.  It does not make sense that they would send you a free system scan.  In fact, nothing about this email is logical.

What Does the Conflicker.b Spam Trojan Do?

Once it is able to enter your system, Conflicker.b installs the install.exe file.  The purpose of this file is to reconfigure your Internet Explorer security settings.  When your security program is updated and running, it will block access to files that may put your computer at risk.  Install.exe allows these potentially corrupt files to run.  It then generates false warning message that read:

Your computer is infected!

Windows has detected spyware infection!

It is recomended to use [sic] special antispyware tools to pervent [sic] data loss.  Windows will now download and install the most up-to-date antispyware for you.  Click here to protect your computer from spyware!

Notice the use of exclamation points, odd syntax, and spelling errors.  These are all classic signs for a rogue program. 

In addition to these issues, the Conflicker.b spam Trojan brings Antivirus Pro 2010, a rogue antivirus program.  The goal of Antivirus Pro 2010 is to persuade computer users that they have security threats in their system that they need to resolve immediately - using Antivirus Pro 2010, of course. 

In order to convince computer users, this rogue antivirus program generates false scans which list several "threats."  Really, these are innocuous files created by Antivirus Pro 2010 to create the illusion of multiple serous security risks.  The rogue program can be effective, especially because it seeks to use computer owners' need to protect their computers to convince them to buy software.  What owners need to know, however, is that just as there are no risks (other than Antivirus Pro 2010 itself), there is no protection.

Rogue antivirus programs offer a lot, but they do not deliver.  They cannot scan your system or detect threats, much less remove them. If left in your system, rogue programs like Antivirus Pro 2010 can ultimately cause system instability.  Like Conflicker.b, they can alter your security settings, which can make your computer more vulnerable to Trojans and viruses.

In addition to these signs, you may also experience slow computer performance, new desktop shortcuts and system tray icons, and hijacked browser settings. 

How Do I Remove the Conflicker.b Spam Trojan?

If you notice these signs, which together are a very clear indication that the Conflicker.b spam Trojan has entered your system, it is important to take immediate steps to remove it.  Trojans like this and programs like Antivirus Pro 2010 are notoriously difficult to remove.  They are designed to hide from normal security measures, so using your add/delete option or running your current virus scan program will not be effective in removing Conflicker.b or Antivirus Pro 2010. 

What can you do?  The best option is to use a specially designed software program to remove the Trojan and/or program automatically.  The benefit of using programs such as ParetoLogic's XoftSpySE is that you can easily and quickly remove the entire program without damaging any necessary files.  It is also quite a bit more cost effective than hiring a computer tech to remove it manually. 

Manual removal is not recommended for those without extensive technical experience for two reasons:  it can be difficult to remove each and every file associated with Conflicker.b, which allows it to remain in your system.  It is also easy to inadvertently delete a necessary file, which could compromise your computer's performance.  If you do have the time and experience, the following will help you remove the Conflicker.b spam Trojan:

Stop Processes:

seres.exe
svcst.exe
lizkavd.exe

Remove Registry Values:

HKEY_LOCAL_MACHINESOFTWAREAntivirusPro_2010
HKEY_LOCAL_MACHINESOFTWAREMicrosoftESENTProcesslizkavd
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallAntivirusPro_2010
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "RunInvalidSignatures" = "1″
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = "zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mov;.mp3;.wav"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "SaveZoneInformation" = "1″
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer "ForceClassicControlPanel" = "1″
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "CheckExeSignatures" = "no"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "mserv"
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "svchost"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftESENTProcesslizkavd
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun "Antivirus Pro 2010″

Delete Files:

%UserProfile%Application Dataseres.exe
%UserProfile%Application Datasvcst.exe
%UserProfile%Application Datalizkavd.exe

Note:  It may also be necessary to remove processes, files, and registry values associated with the rogue antivirus program, Antivirus Pro 2010. 

 to top