TROJ_FAKEAV.FKT

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It may be manually installed by a user.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It may be manually installed by a user.

Installation

This Trojan drops the following non-malicious files:

• %All Users%\Application Data\bc6d4b9b
• %Application Data%\3cb4f0d7
• %User Profile%\Application Data\1a69bbc1

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\qkm.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\mdaw

It modifies the following registry entries:

HKEY_CLASSES_ROOT\.exe
Default = "mdaw"

(Note: The default value data of the said registry entry is "exefile".)

It also creates the following registry entry(ies) as part of its installation routine:

HKEY_CLASSES_ROOT\mdaw
Default = "Application"

HKEY_CLASSES_ROOT\mdaw
Content Type = "application/x-msdownload"

HKEY_CLASSES_ROOT\mdaw\DefaultIcon
Default = "%1"

HKEY_CLASSES_ROOT\mdaw\shell\
open\command
Default = ""%Application Data%\qkm.exe" -a "%1" %*"

HKEY_CLASSES_ROOT\mdaw\shell\
open\command
IsolatedCommand = ""%1" %*"

HKEY_CLASSES_ROOT\mdaw\shell\
runas\command
Default = ""%1" %*"

HKEY_CLASSES_ROOT\mdaw\shell\
runas\command
IsolatedCommand = ""%1" %*"

HKEY_CLASSES_ROOT\mdaw\shell\
start\command
Default = ""%1" %*"

HKEY_CLASSES_ROOT\mdaw\shell\
start\command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Software\Classes\
.exe
Default = "mdaw"

HKEY_CURRENT_USER\Software\Classes\
mdaw
Default = "Application"

HKEY_CURRENT_USER\Software\Classes\
mdaw
Default = "Application"

HKEY_CURRENT_USER\Software\Classes\
mdaw
Content Type = "application/x-msdownload"

HKEY_CURRENT_USER\Software\Classes\
mdaw\DefaultIcon
Default = "%1"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\open\
command
Default = ""Application Data\qkm.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\open\
command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\runas\
command
Default = ""%1" %*"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\runas\
command
IsolatedCommand = ""%1" %*"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\start\
command
Default = ""%1" %*"

HKEY_CURRENT_USER\Software\Classes\
mdaw\shell\start\
command
IsolatedCommand = ""%1" %*"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv

NOTES:

It adds certain entries to the registry so that every time a file with ".exe" extension is executed, its malware copy also runs.

It deletes the registry key related to Windows Update:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv

When executed, this trojan displays a convincing Graphical User Interface of a rogue antivirus called {Operating System} Home Security 2012. Its name varies depending on the infected system's OS. It pretends to scan the system for viruses:

After scanning, it displays fake pop-ups and warnings saying that the system is infected:

It also blocks applications when you try to run them:

Internet browsers also display fake warning messages such as:

Affected browsers are as follows:

• iexplore
• firefox
• chrome
• safari
• opera

All of these fake warnings lead to the same registration page where the user is asked to purchase a full version of the product.

• http://{BLOCKED}onunisiwu.com/

This Trojan also attempts to access the following websites to possibly download other malicious files:

• {BLOCKED}uxoki.com
• {BLOCKED}irecox.com
• {BLOCKED}utegyd.com
• {BLOCKED}ofubyt.com
• {BLOCKED}ivirocis.com
• {BLOCKED}azaj.com
• {BLOCKED}opufanuj.com
• {BLOCKED}ovih.com
• {BLOCKED}amygyjo.com
• {BLOCKED}ocuci.com
• {BLOCKED}ebutiqy.com
• {BLOCKED}ygaden.com
• {BLOCKED}icekem.com
• {BLOCKED}exadytyn.com
• {BLOCKED}awylabep.com
• {BLOCKED}evys.com
• {BLOCKED}acugefel.com
• {BLOCKED}ukas.com
• {BLOCKED}ynycerev.com
• {BLOCKED}elew.com
• {BLOCKED}ivesu.com
• {BLOCKED}utef.com
• {BLOCKED}onunisiwu.com
• {BLOCKED}imozoha.com
• {BLOCKED}uxumo.com
• {BLOCKED}abevyjydu.com
• {BLOCKED}okymyje.com
• {BLOCKED}ajobu.com
• {BLOCKED}efugeb.com
• {BLOCKED}ihejeluw.com
• {BLOCKED}isatum.com
• {BLOCKED}ugylov.com
• {BLOCKED}ejak.com
• {BLOCKED}emadyk.com
• {BLOCKED}ataran.com
• {BLOCKED}ujiwusiwy.com
• {BLOCKED}yhecynovu.com
• {BLOCKED}ycyfaqaba.com
• {BLOCKED}omydefe.com
• {BLOCKED}ycarykeg.com
• {BLOCKED}ifaqago.com
• {BLOCKED}ymova.com
• {BLOCKED}yzaky.com
• {BLOCKED}iwaji.com
• {BLOCKED}acakudyko.com
• {BLOCKED}imokine.com
• {BLOCKED}ocitiz.com
• {BLOCKED}ywyn.com
• {BLOCKED}awif.com
• {BLOCKED}elugamoqe.com
• {BLOCKED}avif.com
• {BLOCKED}egaci.com
• {BLOCKED}