Content

FakeAlert-AG.gen.a!C7ED2BEC

Type
Trojan
SubType
-
Discovery Date
09/25/2008
Length
119320
Minimum DAT
5391 (09/24/2008)
Updated DAT
5391 (09/24/2008)
Minimum Engine
N/A
Description Added
09/25/2008
Description Modified
09/25/2008 2:26 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

File Property Property Value
FileName podmen~1.exe
McAfee Detection FakeAlert-AG.gen.a
Length 119,320 bytes
CRC C7ED2BEC
MD5 35A39451A38E2B8484341134BBA51D82
SHA1 ABED8932117A51CB160839523418AA8C4BC3362D

Other Common Detection Aliases

Company Name Detection Name
Avira HEUR/Crypted
eSafe (Alladin) Suspicious file
microsoft virtool:win32/obfuscator.bi
Sophos Mal/EncPk-FF
Symantec Packed.Generic.188

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following registry elements have been changed:

  • hkey_local_machine\software\microsoft\windows nt\currentversion\tdssdata\
    • affid = 13877
    • subid = 116
  • hkey_local_machine\software\tdss\
    • build = standart
    • type = clicker
  • hkey_local_machine\system\currentcontrolset\control\session manager\
    • pendingfilerenameoperations = \??\c:\docume~1\admini~1\locals~1\temp
      \tdss264c.tmp
    • pendingfilerenameoperations = \??\c:\docume~1\admini~1\locals~1\temp
      \tdss264c.tmp\??\c:\docume~1\admini~1\locals~1\temp\tdss6dd.tmp
  • hkey_local_machine\system\currentcontrolset\services\tdssserv\
    • imagepath = \systemroot\system32\drivers\tdssserv.sys
    • start = 1
    • type = 1

    Symptoms

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

    Characteristics

    Characteristics -

    File Property Property Value
    FileName podmen~1.exe
    McAfee Detection FakeAlert-AG.gen.a
    Length 119,320 bytes
    CRC C7ED2BEC
    MD5 35A39451A38E2B8484341134BBA51D82
    SHA1 ABED8932117A51CB160839523418AA8C4BC3362D

    Other Common Detection Aliases

    Company Name Detection Name
    Avira HEUR/Crypted
    eSafe (Alladin) Suspicious file
    microsoft virtool:win32/obfuscator.bi
    Sophos Mal/EncPk-FF
    Symantec Packed.Generic.188

    System Changes

    These are general defaults for typical path variables. (Although they may differ, these examples are common.):
    %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
    %SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
    %ProgramFiles% = \Program Files

    The following registry elements have been changed:

  • hkey_local_machine\software\microsoft\windows nt\currentversion\tdssdata\
    • affid = 13877
    • subid = 116
  • hkey_local_machine\software\tdss\
    • build = standart
    • type = clicker
  • hkey_local_machine\system\currentcontrolset\control\session manager\
    • pendingfilerenameoperations = \??\c:\docume~1\admini~1\locals~1\temp
      \tdss264c.tmp
    • pendingfilerenameoperations = \??\c:\docume~1\admini~1\locals~1\temp
      \tdss264c.tmp\??\c:\docume~1\admini~1\locals~1\temp\tdss6dd.tmp
  • hkey_local_machine\system\currentcontrolset\services\tdssserv\
    • imagepath = \systemroot\system32\drivers\tdssserv.sys
    • start = 1
    • type = 1

    Symptoms

    Symptoms -

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Method of Infection -

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal -

    Removal -

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A