TROJ_FAKEAV.SMUW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It employs registry shell spawning by adding certain registry entries. This allows this malware to execute even when other applications are opened.

It modifies certain registry entries to disable Security Center functions. Doing this allows this malware to execute its routines without being detected. It modifies registry entries to disable the Windows Firewall settings. This action allows this malware to perform its routines without being deteted by the Windows Firewall.

It deletes the initially executed copy of itself.

It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.

File Size:

342,016 bytes

Memory Resident:

Yes

Initial Samples Received Date:

31 Dec 2010

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

%Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following files:

%System Root%\Documents and Settings\All Users\Application Data\{random}
%Application Data%\{random}
%User Temp%\{random}
%User Profile%\Templates\{random}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan employs registry shell spawning to ensure its execution when certain file types are accessed by adding the following entries:

HKEY_CLASSES_ROOT\2Xy\shell\
open\command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

HKEY_CLASSES_ROOT\K5o\shell\
open\command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

HKEY_CLASSES_ROOT\.exe\shell\
open\command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
.exe
{default} = "2Xy"

HKEY_CURRENT_USER\Software\Classes\
.exe\shell\open\
command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
2Xy\shell\open\
command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

HKEY_CURRENT_USER\Software\Classes\
K5o\shell\open\
command
{default} = ""%Application Data%\{random}.exe" -a "%1" %*"

Other System Modifications

This Trojan modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\FIREFOX.EXE\shell\
open\command
{default} = ""%Application Data%\{random}.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe""

(Note: The default value data of the said registry entry is "%Program Files%\Mozilla Firefox\firefox.exe".)

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\FIREFOX.EXE\shell\
safemode\command
{default} = ""%Application Data%\{random}.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode"

(Note: The default value data of the said registry entry is ""C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode".)

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\IEXPLORE.EXE\shell\
open\command
{default} = ""%Application Data%\{random}.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe""

(Note: The default value data of the said registry entry is ""C:\Program Files\Internet Explorer\iexplore.exe"".)

HKEY_CLASSES_ROOT\.exe
{default} = "2Xy"

(Note: The default value data of the said registry entry is "exefile".)

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\2Xy

HKEY_CLASSES_ROOT\K5o

HKEY_CURRENT_USER\Software\Classes\
2Xy

HKEY_CURRENT_USER\Software\Classes\
K5o

It modifies the following registry entries to disable Security Center functions:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1