TROJ_FAKEAV.SMAH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

When users agree to buy the software, it connects to a certain URL. It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• %Desktop%\Security Tool.lnk
• %Start Menu%\Programs\Security Tool.lnk
• %Application Data%\{random 10-digit number}\{random 10-digit number}.bat
• %Application Data%\{random 10-digit number}\{random 10-digit number}.cfg

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random 10-digit number}\{random 10-digit number}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random 10-digit number}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Install = "%Application Data%\{random 10-digit number}\{random 10-digit number}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random 10-digit number} = "%Application Data%\{random 10-digit number}\{random 10-digit number}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Security Tool

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Security Tool
FirstRun = "{random}"

Backdoor Routine

This Trojan connects to the following websites to send and receive information:

• http://{BLOCKED}curitytest.com/in.php?affid={value}&url={value}

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

When users agree to buy the software, it connects to the following URL to continue the purchase:

• http://www.{BLOCKED}billingsolution.net/buy2.php?affid={value}
• http://www.{BLOCKED}billingsolution.net/?epl={random}

The following window is displayed for users to purchase the fake antivirus program:

It displays the following window and pretends to scan the system: