TROJ_FAKEAV.SMD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\svcst.exe
• %User Profile%\Application Data\seres.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mserv = "%User Profile%\Application Data\svcst.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
svchost = "%User Profile%\Application Data\svcst.exe"

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = "no"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
RunInvalidSignatures = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = "zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mov;.mp3;.wav"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
SaveZoneInformation = "1"

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}erdogalo.com/c1G0T5Sd8grz0Nt4a3Sm8Uf
• http://{BLOCKED}sedumil.com/Rq1St0Om5w8fdc0XXl4LP3b8Lw
• http://{BLOCKED}gertos.com/xqx1RH0n5rr8Az0Cn4c3KX8WRY
• http://{BLOCKED}rdavaf.com/dgQ1h0d5zB8m0fJ4SJM3d8EUW
• http://{BLOCKED}lionkab.com/qbp1A0zl5Is/8imf0AZb4zXL3pYj8Gt
• http://{BLOCKED}leskohuj.com/dM1Jw0nkg5W8Krt0r4v3A8wHw
• http://{BLOCKED}rdosubor.com/m1Fm0ljr5xL8w0rw4cE3STG8l
• http://{BLOCKED}ukager.com/a1ow0V5EJ8u0IPG4uS3OV8lG
• http://{BLOCKED}fertagol.com/pM1qF0dSO5eFb8gh0XF4h3BwW8uT

It saves the files it downloads using the following names:

• %User Profile%\lizkavd.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

NOTES:

This Trojan displays a tooltip which contains the message below to supposedly alert users of an infection:

Your computer is infected!
Windows has detected spyware infection!
It is recomended to use special antispyware tools to pervent data loss.Windows will now download and install the most up-to-date antispyware for you.

Click here to protect your computer from spyware!

The message is displayed once the malware successfully downloaded %User Profile%\lizkavd.exe. This malware then run the said file when the message is clicked.