TROJ_FAKEAV.KTD

This Trojan modifies Internet Explorer security settings. This puts the affected computer at greater risk, as it allows malicious URLs to be accessed by the computer.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Program Files%\AnVi\avt.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It drops the following file(s)/component(s):

• %User Temp%\4otjesjty.mof

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Program Files%\AnVi

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Antivirus = "%Program Files%\AnVi\avt.exe" -noscan

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
=

(Note: The default value data of the said registry entry is .)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Use FormSuggest = Yes

Web Browser Home Page and Search Page Modification

This Trojan modifies Internet Explorer zone settings.

Download Routine

This Trojan saves the files it downloads using the following names:

• %User Temp%\avt.dat
• %User Temp%\avtr.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Other Details

Based on analysis of the codes, it has the following capabilities:

• It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain Web site asking for sensitive information, such as credit card numbers.

It attempts to access the following websites to download files, which are possibly malicious:

• http://{BLOCKED}eager.com/avt/avt_db
• http://{BLOCKED}eager.com/avt/avt.dat
• http://{BLOCKED}eager.com/avt/avtr.dat
• http://{BLOCKED}eager.com/customers/getbuild.php
• http://{BLOCKED}eager.com/avt/avt_db