TROJ_FAKEAV.ATJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %System Root%\DOCUME~1
• %System Root%\DOCUME~1\ADMINI~1
• %User Profile%\LOCALS~1
• %User Temp%\nsp3.tmp
• %Program Files%\Spyware-Secure
• %System Root%\Documents and Settings\Administrator
• %Start Menu%\Programs\Spyware-Secure

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan deletes the following files:

• %User Temp%\nsz1.tmp
• %User Temp%\nsp3.tmp
• %Program Files%\Spyware-Secure\Updates\NSIS_SpywareSecure_setup.exe
• %Program Files%\Spyware-Secure\Updates\NSIS_SpywareSecure_trial_setup.exe
• %Program Files%\Spyware-Secure\Updates\NSIS_SpywareSecure_repaironce_setup.exe
• resources\malwaresDB_1-4
• resources\cookies_1-4.dat
• resources\filesDesc_1-4.dat
• resources\filesDesc_1-4.dic
• resources\filesExt_1-4.dat
• resources\register_1-4.dat
• resources\filesMulti_1-4.idx
• resources\filesSimple_1-4.idx
• resources\malwaresDB_1-5
• resources\cookies_1-5.dat
• resources\filesDesc_1-5.dat
• resources\filesDesc_1-5.dic
• resources\filesExt_1-5.dat
• resources\register_1-5.dat
• resources\filesMulti_1-5.idx
• resources\filesSimple_1-5.idx

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

It deletes the following folders:

• %Program Files%\Spyware-Secure\Temp
• %Program Files%\Spyware-Secure\Updates

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Spyware-Secure\
Spyware-Secure

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure

HKEY_LOCAL_MACHINE\Software\Spyware-Secure

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
DisplayName = "Spyware-Secure "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
UninstallString = "%Program Files%\Spyware-Secure\uninst.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
DisplayIcon = "%Program Files%\Spyware-Secure\Spyware-Secure_trial.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
URLInfoAbout = "http://www.{BLOCKED}e-secure.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
Publisher = "SUAYLLON, S.L."

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Spyware-Secure
NSIS:Language = "1033"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
path = "%Program Files%\Spyware-Secure"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
UAI = "http://www.{BLOCKED}e-secure.com/register.php?nums=N0E1CA00Z0-FDNwT7OAKb&login=672125"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
installdt = "20080703"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
ZMODE = "TRUE"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
nums = "N0E1CA00Z0-FDNwT7OAKb"

HKEY_LOCAL_MACHINE\SOFTWARE\Spyware-Secure
handle = "262352"

Dropping Routine

This Trojan drops the following files:

• %User Temp%\nsz2.tmp
• %User Temp%\nsp3.tmp\LangDLL.dll
• %User Temp%\nsp3.tmp\KillProcDLL.dll
• %User Temp%\nsp3.tmp\ioSpecial.ini
• %User Temp%\nsp3.tmp\modern-wizard.bmp
• %User Temp%\nsp3.tmp\modern-header.bmp
• %User Temp%\nsp3.tmp\InstallOptions.dll
• %Start Menu%\Programs\Spyware-Secure\Spyware-Secure trial.lnk
• %Desktop%\Spyware-Secure trial.lnk
• %Program Files%\Spyware-Secure\Spyware-Secure_trial.exe
• %Program Files%\Spyware-Secure\sws_translations.xml
• %Program Files%\Spyware-Secure\sqlite3.dll
• %Program Files%\Spyware-Secure\unrar.dll
• %Start Menu%\Programs\Spyware-Secure\Website.lnk
• %Program Files%\Spyware-Secure\uninst.exe
• %User Temp%\nsp3.tmp\NSISSpywareSecure2.dll
• %Program Files%\Spyware-Secure\language
• %Program Files%\Spyware-Secure\config.s3db-journal
• skin

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}e-secure.com/scripts/trial.php?{random characters}

This report is generated via an automated analysis system.