TROJ_FAKEAV.ICZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• %User Profile%\Application Data\{random characters}\{random characters}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following component file(s):

• %Desktop%\Live Security Platinum.lnk
• %Start Menu%\Programs\Live Security Platinum.lnk
• %Start Menu%\Programs\Live Security Platinum\Live Security Platinum.lnk

(Note: %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random characters} = %User Profile%\Application Data\{random characters}\{random characters}.exe

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}.{BLOCKED}.178.189/api/urls/?ts=8d7f73b5&affid=41100

Rogue Antivirus Routine

The following window is displayed for users to purchase the fake antivirus program:

• Live Security Platinum

NOTES:
For reference, all the {random characters}, including the dropped copy, registry key and entry are the same for a specific machine but different for every machine where this malware is executed.