Trojan.Win32.FakeAV_a3ed09d61f

by malwarelabrobot on October 24th, 2013 in Malware Descriptions.

Gen:Variant.Strictor.4450 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Gen:Variant.Strictor.4450 (B) (Emsisoft), Artemis!A3ED09D61F76 (McAfee), Trojan.Win32.FakeAV (Ikarus), Gen:Variant.Strictor.4450 (FSecure)
Behaviour: Trojan, Fake-AV


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Technical Details
Removal Recommendations

MD5: a3ed09d61f7622ec506e12f967ae06ba
SHA1: 8ef1c7ea9876138faae41b5051d67f9b13b850ed
SHA256: 02f32ffb7d007bbe98cdc536900ca36152ee4ba6bb3e89113de232fd08c7810c
SSDeep: 49152:CWfWfWzWnWfW4zUODUtMjZUvGB0dJtZ02wH99PBJh0efw:CWfWfWzWnWfW449WZUvGB0d102wH99PW
Size: 2024960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: ExpressInstaller
Created at: 2013-02-12 04:06:08


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Fake-AV. FakeAV programs generate exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.

Payload

No specific payload has been found.

Process activity

The FakeAV creates the following process(es):

a3ed09d61f7622ec506e12f967ae06ba.exe:1664

File activity

Registry activity

The process a3ed09d61f7622ec506e12f967ae06ba.exe:1664 makes changes in a system registry.
The FakeAV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 20 CC 80 19 DB 41 B0 BC E4 D9 02 5A 3B 5B 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Screenshot


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate the original FakeAV process (How to End a Process With the Task Manager).
  2. Delete the original Gen:Variant file.
  3. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.