TROJ_FAKEAV.IVH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

When users agree to buy the software, it connects to a certain URL. It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• %Desktop%\Live Security Platinum.lnk
• %Start Menu%\Programs\Live Security Platinum\Live Security Platinum.lnk
• {All User's Profile}\Application Data\{random folder name}\{random file name}
• {All User's Profile}\Application Data\{random folder name}\{random file name}.ico

(Note: %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• {All User's Profile}\Application Data\{random folder name}\{random file name}.exe

It creates the following folders:

• {All User's Profile}\Application Data\{random folder name}
• %Start Menu%\Programs\Live Security Platinum

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random file name} = "{All User's Profile}\Application Data\{random folder name}\{random file name}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Installer

HKEY_CURRENT_USER\Software\Microsoft\
Installer\Products

HKEY_CURRENT_USER\Software\Microsoft\
Installer\Products\{random key name}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Installer\Products\{random key name}
(Default) = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
DisplayName = "Live Security Platinum"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
ShortcutPath = ""{All User's Profile}\Application Data\{random folder name}\{random file name}.exe" -u"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
UninstallString = ""{All User's Profile}\Application Data\{random folder name}\{random file name}.exe" -u"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
DisplayIcon = "{All User's Profile}\Application Data\{random folder name}\{random file name}.ico,0"

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.224.31/api/stats/install/?ts={number}&affid={number}&ver={number}&group=liv

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

When users agree to buy the software, it connects to the following URL to continue the purchase:

• http://{BLOCKED}.{BLOCKED}.224.31/api/urls/?ts={number}&affid={number}

The following window is displayed for users to purchase the fake antivirus program:

It displays the following window and pretends to scan the system:

NOTES:

This Trojan terminates processes except the following:

• alg.exe
• csrss.exe
• ctfmon.exe
• iexplore.exe
• lsass.exe
• services.exe
• smss.exe
• svchost.exe
• winlogon.exe