TROJ_FAKEAV.FDHQ

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites. It may be manually installed by a user.

It deletes itself after execution.

It displays fake alerts.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

It may be manually installed by a user.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{random folder name}\{random file name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious files:

• %Application Data%\{random folder name}\{random file name}
• %System Root%\fsqwr.bmp - fake blue screen image

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Don't stop me! I give work and money for you!

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random file name} = "%Application Data%\{random folder name}\{random file name}.exe"

Other System Modifications

This Trojan sets the system's desktop wallpaper to the following image:

Other Details

This Trojan deletes itself after execution.

Rogue Antivirus Routine

This Trojan displays fake alerts.

NOTES:
This Trojan poses as a legitimate antivirus called System Tool. It uses a convincing graphical user interface and warning messages to indicate that the system is infected.

• http://{BLOCKED}.{BLOCKED}.216.82/buy.php?affid={id}
• http://{BLOCKED}.{BLOCKED}.209.245/buy.php?affid={id}