What is SystemWarrior

SystemWarrior is a computer program designed for the purpose to deceive internet users, by asking them to pay for useless software. The main task - using fraudulent techniques, convince user that the computer system is infected with viruses and requires immediate assistance. SystemWarrior is installed by Trojan.FakeSmoke and is closely related to fake Windows Security Center and Internet browser redirects (a notification of a virus attack along with recommended false computer security application will be displayed instead of a website user is expecting to view).

All of the alerts generated by SystemWarrior are faked and used only in order to scare user, making him to seek for possible solutions. In fact, a solution is offered at the same time - rogue application, which has to be downloaded. SystemWarrior is one of them. Here are fake alerts generated by SystemWarrior:

• Spyware Alert!
  Your computer is infected with spyware. It could damage your critical files or expose your private data on the internet. Click here to register your copy of SystemWarrior and remove spyware threats from your PC.
• Attention: DANGER!
  SystemWarrior has detected 721 critical spyware objects while scanning the system. Register SystemWarrior to block or remove threatening objects. Click "Remove" to register the version to render revealed threats.
• Windows Security Center
  Your computer is infected by spyware - threat have been found while scanning your files and registry. It is strongly recommended that you disinfect your PC and activate realtime protection against future intrusions. Register the SystemWarrior antispyware to clean your computer and prevent new security and privacy attacks. You will be able to downloads database updates and get online protection against internet attacks.
• Infiltration Alert!
  Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan-dropper or similar. Do you want SystemWarrior to block this attack?

Right after user downloaded and installed rogue program (automatic download and installation may be common for some rogue applications), simulated computer scan for viruses, Trojans and other threats will be launched. To show user that viruses exist, during SystemWarrior installation over 700 different chaotically-named files will be uploaded to C:\Windows\ and C:\Windows\System32\ directories, assigning them the names of various threats. After the "scan" is done, user will be prompted about malicious objects by supplying the report, which is significantly overstated. Objects in the report cannot harm the computer, more serious problem - SystemWarrior itself, so it must be removed as soon as possible.

O4 - HKLM\..\Run: [SystemWarrior] "C:\Program Files\SystemWarrior Software\SystemWarrior\SystemWarrior.exe" -min

O4 - HKCU\..\Run: [cfr2.tmp.exe] C:\WINDOWS\system32\cfr2.tmp.exe