TROJ_WINWEBSE.AU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

When users agree to buy the software, it connects to a certain URL. It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• %Desktop%\Security Tool.lnk
• %Start Menu%\Programs\Security Tool.lnk
• %All Users Profile%\{random folder name}\{random filename}.bat

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %All Users Profile%\Application Data\{random folder name}\{random filename}.exe (For Windows XP)
• %All Users Profile%\{random folder name}\{random filename}.exe (For Windows Vista and 7)
• %System Root%\Users\All Users\{random folder name}\{random filename}.exe (For Windows Vista and 7)

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %All Users Profile%\Application Data\{random folder name} (For Windows XP)
• %All Users Profile%\{random folder name} (For Windows Vista and 7)
• %System Root%\Users\All Users\{random folder name} (For Windows Vista and 7)

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random name} = "%All Users Profile%\{random folder name}\{random filename}.exe" (For Windows Vista and Windows 7)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random name} = "%All Users Profile%\Application Data\{random folder name}\{random filename}.exe" (For Windows XP)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\{random digit}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{random digit}
Grep = “{random value}”

Other Details

This Trojan deletes itself after execution.

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

When users agree to buy the software, it connects to the following URL to continue the purchase:

• http://{BLOCKED}.{BLOCKED}.211.6/buy2.php?affid={value}&sts={value}
• http://{BLOCKED}d.{BLOCKED}f.yt:443
• http://{BLOCKED}.{BLOCKED}.65.204/buy2.php?affid={value}&sts={value}

The following window is displayed for users to purchase the fake antivirus program:

It displays the following window and pretends to scan the system:

NOTES:
Upon execution, this malware connects to the following website to send information:

• http://{BLOCKED}.{BLOCKED}.60.126/set.php?url={value}&affid={value}&sts={value}&win={OS Version}