TROJ_FAKEAV.LDG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\sckfems.dll
• %System%\sbfihrqe.otr
• %System%\kmgwxrap.hip
• %System Root%\Documents and Settings\All Users\Application Data\{Random File Name}
• %System Root%\Documents and Settings\All Users\Application Data\~{Random File Name}
• %System Root%\Documents and Settings\All Users\Application Data\~{Random File Name}r
• %Application Data%\GDIPFONTCACHEV1.DAT
• %Start Menu%\Programs\System Fix\System Fix.lnk
• %Start Menu%\Programs\System Fix\Uninstall System Fix.lnk
• %User Profile%\Desktop\System Fix.lnk
• %User Profile%\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\{Random File Name}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %Start Menu%\Programs\System Fix

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\devjcc\Parameters
ServiceDll = %System%\sckfems.dll

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Use FormSuggest = "Yes"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnZoneCrossing = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonBadCertRecving = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
CertificateRevocation = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
3486:TCP = "3486:TCP:*:Enabled:WWW"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1601 = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\sr\Parameters
FirstRun = 1

(Note: The default value data of the said registry entry is 0.)

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://getmyip.co.uk/
• http://checkip.dyndns.org/

It connects to the following possibly malicious URL:

• http://{BLOCKED}luraw.com/britix/a
• http://{BLOCKED}heamedy.com/up.php?0Q9oBPXEN0uECUgzEJ95RQsajjnvq1aG3F/2q5oNvBGAyHya0iCkBIHoIxsgj7n41ezh
• http://{BLOCKED}luraw.com/britix/a
• http://{BLOCKED}luraw.com/britix/ar
• http://{BLOCKED}ngelog.com/britix/a
• http://{BLOCKED}.{BLOCKED}.146.1:9958/tusp
• http://www.{BLOCKED}an.com/japanese-used-vehicles-cn0

It deletes the initially executed copy of itself