TROJ_FAKEAV.KLD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not drop any other file.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Internet Security = "{malware path}\{malware file name}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\{random key}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random key}
FRun = "0"

HKEY_CURRENT_USER\Software\{random key}
O`ld = "{random value 1}"

HKEY_CURRENT_USER\Software\{random key}
Q`ui = "{random value 2}"

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Dropping Routine

This Trojan does not drop any other file.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

It displays the following window and pretends to scan the system:

NOTES:

By Clicking the [Get full time protection now], it will trigger any of these Activation Windows:

Then by clicking Activate Now, it will redirect to this URL:

• http://{BLOCKED}tyserviceauto.com/buynow.php?bid=105

When Clicking Proceed to Checkout, it will prompt the user to enter credit card information on this URL:

• https://{BLOCKED}e.{BLOCKED}ling.com/order/pay

After providing the credit card information and clicking Secure Purchase, it will direct to this URL:

• http://{BLOCKED}rtal360.com/404.php?id=%advid%

This Trojan terminates processes except the following:

• explorer.exe
• lsass.exe
• ctfmon.exe
• csrss.exe
• spoolsv.exe
• svchost.exe
• services.exe
• winlogon.exe
• smss.exe
• rundll32.exe
• wscntfy.exe
• SearchIndexer.exe
• msfeedssync.exe
• services.exe
• WmiPrvSE.exe
• internat.exe
• ielowutil.exe
• VMwareService.exe
• VMwareTray.exe
• userinit.exe
• MpfAlert.exe
• mcmscsvc.exe

It does not have rootkit capabilities.

It does not exploit any vulnerability.