TROJ_FAKEAV.FJV

This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It may be manually installed by a user.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It may be manually installed by a user.

Installation

This Trojan drops the following files:

• %Application Data%\{random}
• %Application Data%\~{random}
• %Application Data%\~{random}{random char}
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
• %User Profile%\Desktop\System Check.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Start Menu%\Programs\System Check

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %Start Menu%\Programs\System Check\System Check.lnk
• %Start Menu%\Programs\System Check\Uninstall System Check.lnk

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnZoneCrossing = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonBadCertRecving = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
CertificateRevocation = "0"

NOTES:

Upon execution, this program displays a GUI that scans the system for errors.

After scanning, it prompts the user to fix the errors found:

However, it fails to fix all the fake errors and asks the user to purchase the software for the full version. The "Buy Now" page looks like the following:

It attempts to access the following URLs:

• http://{BLOCKED}eigol.com/britix/a
• http://{BLOCKED}eigol.com/britix/ar
• http://{BLOCKED}eigol.com/up.php?{base64 encoded data}