TROJ_FAKEAV.SMEE

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It listens on ports.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following copies of itself into the affected system:

• ％User Temp%\{random folder}\{random file name}.exe

It creates the following folders:

• ％User Temp%\{random folder}

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random string} = "%User Temp%\{random folder}\{random file name}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\qnpn7rjv93lf

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
EnabledV8 = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
Enabled = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
RunInvalidSignatures = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyServer = "http=127.0.0.1:59274"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyOverride = ""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = ".exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = 1

HKEY_CURRENT_USER\Software\qnpn7rjv93lf
knkd = 1

HKEY_CURRENT_USER\Software\qnpn7rjv93lf
id = "84.2"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = "no"

(Note: The default value data of the said registry entry is "yes".)

Backdoor Routine

This Trojan listens on the following ports:

• TCP Port 59274

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}spy.net/check?pgid=8
• http://{BLOCKED}spy.net/percer.php?login=ODQuMg==