Content

FakeAlert-EA

Type
Trojan
SubType
Win32
Discovery Date
06/10/2009
Length
Varies
Minimum DAT
5642 (06/10/2009)
Updated DAT
5878 (01/31/2010)
Minimum Engine
5.3.00
Description Added
06/10/2009
Description Modified
09/30/2009 10:51 PM (PT)
Risk Assessment
Corporate User
Low-Profiled
Home User
Low-Profiled

Tab Navigation

Characteristics

-- Update October 1, 2009 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.netguide.co.nz/200910011177/latest-malware-exploit-tsunami-warnings.php

--

When executed, this malware displays the following image:


It would then run an exaggerated scan and generate false detection alert messages and warnings. The intention behind all the fake messages is drive users to purchase the advertised product.

The malware also drops copies of itself along with other configuration files as follows:

  • %CommonAppData%\e4a12b7\28.mof
  • %CommonAppData%\e4a12b7\WPe4a1.exe
  • %CommonAppData%\WPCDSys\wpcd.cfg

Note:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

It then modifies the host file typically located in "C:\Windows\System32\drivers\etc\hosts" with the following URL to IP mappings:

  • 74.125.45[Removed] 4-open-davinci.com
  • 74.125.45[Removed] securitysoftwarepayments.com
  • 74.125.45[Removed] privatesecuredpayments.com
  • 74.125.45[Removed] secure.privatesecuredpayments.com
  • 74.125.45[Removed] getantivirusplusnow.com
  • 74.125.45[Removed] secure-plus-payments.com
  • 74.125.45[Removed] www.getantivirusplusnow.com
  • 74.125.45[Removed] www.secure-plus-payments.com
  • 74.125.45[Removed] www.getavplusnow.com
  • 74.125.45[Removed] www.securesoftwarebill.com
  • 74.125.45[Removed] secure.paysecuresystem.com
  • 74.125.45[Removed] paysoftbillsolution.com
  • 64.86.16[Removed] google.ae
  • 64.86.16[Removed] google.as
  • 64.86.16[Removed] google.at
  • 64.86.16[Removed] google.az
  • 64.86.16[Removed] google.ba
  • 64.86.16[Removed] google.be
  • 64.86.16[Removed] google.bg
  • 64.86.16[Removed] google.bs
  • 64.86.16[Removed] google.ca
  • 64.86.16[Removed] google.cd
  • 64.86.16[Removed] google.com.gh
  • 64.86.16[Removed] google.com.hk
  • 64.86.16[Removed] google.com.jm
  • 64.86.16[Removed] google.com.mx
  • 64.86.16[Removed] google.com.my
  • 64.86.16[Removed] google.com.na
  • 64.86.16[Removed] google.com.nf
  • 64.86.16[Removed] google.com.ng
  • 64.86.16[Removed] google.ch
  • 64.86.16[Removed] google.com.np
  • 64.86.16[Removed] google.com.pr
  • 64.86.16[Removed] google.com.qa
  • 64.86.16[Removed] google.com.sg
  • 64.86.16[Removed] google.com.tj
  • 64.86.16[Removed] google.com.tw
  • 64.86.16[Removed] google.dj
  • 64.86.16[Removed] google.de
  • 64.86.16[Removed] google.dk
  • 64.86.16[Removed] google.dm
  • 64.86.16[Removed] google.ee
  • 64.86.16[Removed] google.fi
  • 64.86.16[Removed] google.fm
  • 64.86.16[Removed] google.fr
  • 64.86.16[Removed] google.ge
  • 64.86.16[Removed] google.gg
  • 64.86.16[Removed] google.gm
  • 64.86.16[Removed] google.gr
  • 64.86.16[Removed] google.ht
  • 64.86.16[Removed] google.ie
  • 64.86.16[Removed] google.im
  • 64.86.16[Removed] google.in
  • 64.86.16[Removed] google.it
  • 64.86.16[Removed] google.ki
  • 64.86.16[Removed] google.la
  • 64.86.16[Removed] google.li
  • 64.86.16[Removed] google.lv
  • 64.86.16[Removed] google.ma
  • 64.86.16[Removed] google.ms
  • 64.86.16[Removed] google.mu
  • 64.86.16[Removed] google.mw
  • 64.86.16[Removed] google.nl
  • 64.86.16[Removed] google.no
  • 64.86.16[Removed] google.nr
  • 64.86.16[Removed] google.nu
  • 64.86.16[Removed] google.pl
  • 64.86.16[Removed] google.pn
  • 64.86.16[Removed] google.pt
  • 64.86.16[Removed] google.ro
  • 64.86.16[Removed] google.ru
  • 64.86.16[Removed] google.rw
  • 64.86.16[Removed] google.sc
  • 64.86.16[Removed] google.se
  • 64.86.16[Removed] google.sh
  • 64.86.16[Removed] google.si
  • 64.86.16[Removed] google.sm
  • 64.86.16[Removed] google.sn
  • 64.86.16[Removed] google.st
  • 64.86.16[Removed] google.tl
  • 64.86.16[Removed] google.tm
  • 64.86.16[Removed] google.tt
  • 64.86.16[Removed] google.us
  • 64.86.16[Removed] google.vu
  • 64.86.16[Removed] google.ws
  • 64.86.16[Removed] google.co.ck
  • 64.86.16[Removed] google.co.id
  • 64.86.16[Removed] google.co.il
  • 64.86.16[Removed] google.co.in
  • 64.86.16[Removed] google.co.jp
  • 64.86.16[Removed] google.co.kr
  • 64.86.16[Removed] google.co.ls
  • 64.86.16[Removed] google.co.ma
  • 64.86.16[Removed] google.co.nz
  • 64.86.16[Removed] google.co.tz
  • 64.86.16[Removed] google.co.ug
  • 64.86.16[Removed] google.co.uk
  • 64.86.16[Removed] google.co.za
  • 64.86.16[Removed] google.co.zm
  • 64.86.16[Removed] google.com

This is done to ensure that any attempts to connect to the above legitimate sites, will be redirected to the malicious IP address instead.

The malware then modifies the following registry entries to disable access to commonly used security and system tools:

  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution ptions\About.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirus_Pro.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apimonitor.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Arrakis3.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashBug.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashCnsnt.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashPopWz.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimpl.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPck.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atguard.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto-protect.nav80try.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgchk.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgdumpx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgiproxy.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgsrmax.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupd.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe

The data for the above registry entries is changed to:

  • Debugger = "svchost.exe"

This ensures that every time the above known security application are invoked, svchost.exe is run instead.

The malware then attempts to connect to the following sites, possibly to GET or POST more information from the malicious server:

  • http://update1.windowspc-[Removed]download.php
  • http://security[Removed]gethash.php
  • http://security[Removed]download.php
  • http://security[Removed]/get_product_domains.php
  • http://security[Removed]/install-report.php
  • http://security[Removed]/SoftServiceReport.php
  • http://mysecurity[Removed]/minstalls.php

Symptoms

Presence of files and registry entries mentioned earlier.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This description is for malware that shows false error messages, misleading spyware scan results, and uses aggressive advertising to persuade the user to purchase it.

Aliases

  • SecurityRisk.Downldr [Symantec]
  • Troj/FakeAV-ABP [Sophos]
  • TROJ_FRAUDLO.IS [Trend Micro]
  • Trojan-Downloader.Win32.FraudLoad [Ikarus]
  • Trojan-Downloader.Win32.FraudLoad.fot [Kaspersky]
  • TrojanDownloader:Win32/FakeVimes [Microsoft]
  • Win32/TrojanDownloader.FakeAlert.AJB [Eset]
  • Windows PC Defender[CA eTrust]

Characteristics

Characteristics -

-- Update October 1, 2009 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.netguide.co.nz/200910011177/latest-malware-exploit-tsunami-warnings.php

--

When executed, this malware displays the following image:


It would then run an exaggerated scan and generate false detection alert messages and warnings. The intention behind all the fake messages is drive users to purchase the advertised product.

The malware also drops copies of itself along with other configuration files as follows:

  • %CommonAppData%\e4a12b7\28.mof
  • %CommonAppData%\e4a12b7\WPe4a1.exe
  • %CommonAppData%\WPCDSys\wpcd.cfg

Note:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

It then modifies the host file typically located in "C:\Windows\System32\drivers\etc\hosts" with the following URL to IP mappings:

  • 74.125.45[Removed] 4-open-davinci.com
  • 74.125.45[Removed] securitysoftwarepayments.com
  • 74.125.45[Removed] privatesecuredpayments.com
  • 74.125.45[Removed] secure.privatesecuredpayments.com
  • 74.125.45[Removed] getantivirusplusnow.com
  • 74.125.45[Removed] secure-plus-payments.com
  • 74.125.45[Removed] www.getantivirusplusnow.com
  • 74.125.45[Removed] www.secure-plus-payments.com
  • 74.125.45[Removed] www.getavplusnow.com
  • 74.125.45[Removed] www.securesoftwarebill.com
  • 74.125.45[Removed] secure.paysecuresystem.com
  • 74.125.45[Removed] paysoftbillsolution.com
  • 64.86.16[Removed] google.ae
  • 64.86.16[Removed] google.as
  • 64.86.16[Removed] google.at
  • 64.86.16[Removed] google.az
  • 64.86.16[Removed] google.ba
  • 64.86.16[Removed] google.be
  • 64.86.16[Removed] google.bg
  • 64.86.16[Removed] google.bs
  • 64.86.16[Removed] google.ca
  • 64.86.16[Removed] google.cd
  • 64.86.16[Removed] google.com.gh
  • 64.86.16[Removed] google.com.hk
  • 64.86.16[Removed] google.com.jm
  • 64.86.16[Removed] google.com.mx
  • 64.86.16[Removed] google.com.my
  • 64.86.16[Removed] google.com.na
  • 64.86.16[Removed] google.com.nf
  • 64.86.16[Removed] google.com.ng
  • 64.86.16[Removed] google.ch
  • 64.86.16[Removed] google.com.np
  • 64.86.16[Removed] google.com.pr
  • 64.86.16[Removed] google.com.qa
  • 64.86.16[Removed] google.com.sg
  • 64.86.16[Removed] google.com.tj
  • 64.86.16[Removed] google.com.tw
  • 64.86.16[Removed] google.dj
  • 64.86.16[Removed] google.de
  • 64.86.16[Removed] google.dk
  • 64.86.16[Removed] google.dm
  • 64.86.16[Removed] google.ee
  • 64.86.16[Removed] google.fi
  • 64.86.16[Removed] google.fm
  • 64.86.16[Removed] google.fr
  • 64.86.16[Removed] google.ge
  • 64.86.16[Removed] google.gg
  • 64.86.16[Removed] google.gm
  • 64.86.16[Removed] google.gr
  • 64.86.16[Removed] google.ht
  • 64.86.16[Removed] google.ie
  • 64.86.16[Removed] google.im
  • 64.86.16[Removed] google.in
  • 64.86.16[Removed] google.it
  • 64.86.16[Removed] google.ki
  • 64.86.16[Removed] google.la
  • 64.86.16[Removed] google.li
  • 64.86.16[Removed] google.lv
  • 64.86.16[Removed] google.ma
  • 64.86.16[Removed] google.ms
  • 64.86.16[Removed] google.mu
  • 64.86.16[Removed] google.mw
  • 64.86.16[Removed] google.nl
  • 64.86.16[Removed] google.no
  • 64.86.16[Removed] google.nr
  • 64.86.16[Removed] google.nu
  • 64.86.16[Removed] google.pl
  • 64.86.16[Removed] google.pn
  • 64.86.16[Removed] google.pt
  • 64.86.16[Removed] google.ro
  • 64.86.16[Removed] google.ru
  • 64.86.16[Removed] google.rw
  • 64.86.16[Removed] google.sc
  • 64.86.16[Removed] google.se
  • 64.86.16[Removed] google.sh
  • 64.86.16[Removed] google.si
  • 64.86.16[Removed] google.sm
  • 64.86.16[Removed] google.sn
  • 64.86.16[Removed] google.st
  • 64.86.16[Removed] google.tl
  • 64.86.16[Removed] google.tm
  • 64.86.16[Removed] google.tt
  • 64.86.16[Removed] google.us
  • 64.86.16[Removed] google.vu
  • 64.86.16[Removed] google.ws
  • 64.86.16[Removed] google.co.ck
  • 64.86.16[Removed] google.co.id
  • 64.86.16[Removed] google.co.il
  • 64.86.16[Removed] google.co.in
  • 64.86.16[Removed] google.co.jp
  • 64.86.16[Removed] google.co.kr
  • 64.86.16[Removed] google.co.ls
  • 64.86.16[Removed] google.co.ma
  • 64.86.16[Removed] google.co.nz
  • 64.86.16[Removed] google.co.tz
  • 64.86.16[Removed] google.co.ug
  • 64.86.16[Removed] google.co.uk
  • 64.86.16[Removed] google.co.za
  • 64.86.16[Removed] google.co.zm
  • 64.86.16[Removed] google.com

This is done to ensure that any attempts to connect to the above legitimate sites, will be redirected to the malicious IP address instead.

The malware then modifies the following registry entries to disable access to commonly used security and system tools:

  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution ptions\About.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirus_Pro.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apimonitor.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Arrakis3.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashBug.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashCnsnt.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashPopWz.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimpl.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPck.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atguard.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto-protect.nav80try.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgchk.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgdumpx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgiproxy.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgsrmax.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupd.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe
  • HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe

The data for the above registry entries is changed to:

  • Debugger = "svchost.exe"

This ensures that every time the above known security application are invoked, svchost.exe is run instead.

The malware then attempts to connect to the following sites, possibly to GET or POST more information from the malicious server:

  • http://update1.windowspc-[Removed]download.php
  • http://security[Removed]gethash.php
  • http://security[Removed]download.php
  • http://security[Removed]/get_product_domains.php
  • http://security[Removed]/install-report.php
  • http://security[Removed]/SoftServiceReport.php
  • http://mysecurity[Removed]/minstalls.php

Symptoms

Symptoms -

Presence of files and registry entries mentioned earlier.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal -

Removal -

A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A