TROJ_FAKEAV.SGN

This Trojan may arrive bundled with malware packages as a malware component. It may be unknowingly downloaded by a user while visiting malicious websites.

It is injected into all running processes to remain memory resident.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following file(s)/component(s):

• %User Temp%\expand32xp.dll
• %User Temp%\topwesitjh
• %User Temp%\wmsdk64_32.exe
• %User Temp%\wscsvc32.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It checks if it is installed or dropped in the following folder:

• %Program Files%\AnVi

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It is injected into all running processes to remain memory resident.

Autostart Technique

This Trojan creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
wmsdk64_32.exe = "%User Temp%\wmsdk64_32.exe"

Other System Modifications

This Trojan also creates the following registry entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Printers\Connections
time = "1"

(Note: The default value data of the said registry entry is .)

It adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

(Note: The default value data of the said registry entry is .)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = "1"

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}y-traffic.com
• http://{BLOCKED}fertile.com

Rogue Antivirus Routine

This Trojan displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.