TROJ_FAKEAV.GER

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• %Application Data%\Security Solution\IcoActivate.ico
• %Application Data%\Security Solution\IcoHelp.ico
• %Application Data%\Security Solution\IcoUninstall.ico
• %Application Data%\Security Solution\Security Solution.exe
• %Application Data%\Security Solution\securitymanager.exe
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Security Solution.lnk
• %Desktop%\Security Solution.lnk
• %Start Menu%\Programs\Security Solution\Activate Security Solution.lnk
• %Start Menu%\Programs\Security Solution\Help Security Solution.lnk
• %Start Menu%\Programs\Security Solution\How to Activate Security Solution.lnk
• %Start Menu%\Programs\Security Solution\Security Solution.lnk
• %Start Menu%\Programs\Security Solution.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\Security Solution\securityhelper.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\Security Solution
• %Start Menu%\Programs\Security Solution

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Security Solution = ""%Application Data%\Security Solution\Security Solution.exe" /STARTUP"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Security Solution 2011 Security = "%Application Data%\Security Solution\securitymanager.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Security Solution

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Security Solution

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}rtualmachine.us

However, as of this writing, the said sites are inaccessible.