Content
FakeAlert-AB.dldr
- Type
- Trojan
- SubType
- Downloader
- Discovery Date
- 01/09/2008
- Length
- various
- Minimum DAT
- 5203 (01/09/2008)
- Updated DAT
- 5486 (01/05/2009)
- Minimum Engine
- 5.2.00
- Description Added
- 01/09/2008
- Description Modified
- 08/21/2008 9:26 AM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
--Update on August 20, 2008 ---
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.itbusinessedge.com/blogs/hdw/?p=2897
and http://newsblaze.com/story/2008081510190500001.wi/topstory.html
The trojan author uses a fake BBC news about President of Georgia to spread the malware. The spammed emails contain a link, which would cause downloading an executable file, often called name.avi.exe.
Upon the execution, the desktop background of the compromised machine is changed:
The desktop and screen saver tabs in "Display Properties" window disappear to disable the victim to manually change them.
A window is pop up to ask the victim to agree to install Antivirus XP 2008. There is cancel or close button in this window.
When the victim clicks the agree and install button, the Antivirus XP 2008 scan window is displayed.
The malware drops the following files:
%USER_PROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
%USER_PROFILE%\Local Settings\Temp\.tt1D.tmp
%USER_PROFILE%\Local Settings\Temp\.tt1D.tmp.vbs
C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
C:\Program Files\rhcv8nj0eefc\database.dat
C:\Program Files\rhcv8nj0eefc\license.txt
C:\Program Files\rhcv8nj0eefc\MFC71.dll
C:\Program Files\rhcv8nj0eefc\MFC71ENU.DLL
C:\Program Files\rhcv8nj0eefc\msvcp71.dll
C:\Program Files\rhcv8nj0eefc\msvcr71.dll
C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe
C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe.local
C:\Program Files\rhcv8nj0eefc\Uninstall.exe
%WinDir%\system32\Restore\MachineGuid.txt
%WinDir%\system32\blphcr8nj0eefc.scr
%WinDir%\system32\pphcr8nj0eefc.exe
(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)
(where %USER_PROFILE% is the default user profile folder, for example C:\Documents and Settings\Administrator if the current user is Administrator.)
It creates or modifies the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcv8nj0eefc: 00 82 AC 48
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\AntivirXP08: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcr8nj0eefc: "%WinDir%\System32\lphcr8nj0eefc.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SMrhcv8nj0eefc: "C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcv8nj0eefc\DisplayName: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcv8nj0eefc\UninstallString: ""C:\Program Files\rhcv8nj0eefc\uninstall.exe""
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\domain: "5B13A361646217A08DAF45C0FAB6AA64BF0E"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ADVid: "687a874463df9e3b7abb1f2150607f7a"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\: "C:\Program Files\rhcv8nj0eefc"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\InstallDir: "C:\Program Files\rhcv8nj0eefc"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\SoftID: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\DatabaseVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProgramVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\EngineVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\GuiVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProxyName: ""
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProxyPort: 0x00000000
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanPriority: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\DaysInterval: 0x00000007
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanDepth: 0x00000002
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanSystemOnStartup: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\AutomaticallyUpdates: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\MinimizeOnStart: 0x00000000
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\BackgroundScan: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\BackgroundScanTimeout: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\LastTimeStamp: 0x00000104
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage: 0x00000001
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000000
HKEY_USERS\Control Panel\Colors\Background: "0 0 255"
HKEY_USERS\Control Panel\Desktop\SCRNSAVE.EXE: "C:\WINDOWS\System32\blphcr8nj0eefc.scr"
HKEY_USERS\Control Panel\Desktop\Wallpaper: "%WinDir%\System32\phcr8nj0eefc.bmp"
HKEY_USERS\Control Panel\Desktop\WallpaperStyle: "0"
HKEY_USERS\Control Panel\Desktop\OriginalWallpaper: "%WinDir%\System32\phcr8nj0eefc.bmp"
It connects with the following remote server:
-
antivirusxp-08.net
-------------------------------------------
This is an automatically generated description for Trojan Downloaders.
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
As it is trivial for the malware author to modify the Downloader to refer to a different website or web address, McAfee write detection routines for Downloaders which as a general rule do not include these strings in the detection routines.
This allows McAfee to write more generic detections for these threats and to proactively protect customers against future minor variants.
Therefore it is not possible to guarantee which website and/or port is being communicated with.
Also, as the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behaviour of these new binaries altered - possibly with every user infection.
Symptoms
Many of these Downloaders install other malware including viruses as well as other Trojans.
Additionally many of them are used to remotely install Adware packages onto the affected host machine for the purposes of gaining referral revenue from the Adware software vendor.
Please note: If Adware is installed via a Downloader it may install it "cleanly" with the relevant uninstaller included for the user to terminate this Adware, although frequently this is not the case.
Method of Infection
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal
Use the latest Engine/Dats
Variants
Variants
N/A
All Information
Overview -
--Update on August 20, 2008 ---
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.itbusinessedge.com/blogs/hdw/?p=2897
and http://newsblaze.com/story/2008081510190500001.wi/topstory.html
The trojan author uses a fake BBC news about President of Georgia to spread the malware.
Characteristics
Characteristics -
--Update on August 20, 2008 ---
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.itbusinessedge.com/blogs/hdw/?p=2897
and http://newsblaze.com/story/2008081510190500001.wi/topstory.html
The trojan author uses a fake BBC news about President of Georgia to spread the malware. The spammed emails contain a link, which would cause downloading an executable file, often called name.avi.exe.
Upon the execution, the desktop background of the compromised machine is changed:
The desktop and screen saver tabs in "Display Properties" window disappear to disable the victim to manually change them.
A window is pop up to ask the victim to agree to install Antivirus XP 2008. There is cancel or close button in this window.
When the victim clicks the agree and install button, the Antivirus XP 2008 scan window is displayed.
The malware drops the following files:
%USER_PROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
%USER_PROFILE%\Local Settings\Temp\.tt1D.tmp
%USER_PROFILE%\Local Settings\Temp\.tt1D.tmp.vbs
C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk
C:\Program Files\rhcv8nj0eefc\database.dat
C:\Program Files\rhcv8nj0eefc\license.txt
C:\Program Files\rhcv8nj0eefc\MFC71.dll
C:\Program Files\rhcv8nj0eefc\MFC71ENU.DLL
C:\Program Files\rhcv8nj0eefc\msvcp71.dll
C:\Program Files\rhcv8nj0eefc\msvcr71.dll
C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe
C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe.local
C:\Program Files\rhcv8nj0eefc\Uninstall.exe
%WinDir%\system32\Restore\MachineGuid.txt
%WinDir%\system32\blphcr8nj0eefc.scr
%WinDir%\system32\pphcr8nj0eefc.exe
(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)
(where %USER_PROFILE% is the default user profile folder, for example C:\Documents and Settings\Administrator if the current user is Administrator.)
It creates or modifies the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcv8nj0eefc: 00 82 AC 48
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\AntivirXP08: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcr8nj0eefc: "%WinDir%\System32\lphcr8nj0eefc.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SMrhcv8nj0eefc: "C:\Program Files\rhcv8nj0eefc\rhcv8nj0eefc.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcv8nj0eefc\DisplayName: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcv8nj0eefc\UninstallString: ""C:\Program Files\rhcv8nj0eefc\uninstall.exe""
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\domain: "5B13A361646217A08DAF45C0FAB6AA64BF0E"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ADVid: "687a874463df9e3b7abb1f2150607f7a"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\: "C:\Program Files\rhcv8nj0eefc"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\InstallDir: "C:\Program Files\rhcv8nj0eefc"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\SoftID: "AntivirXP08"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\DatabaseVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProgramVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\EngineVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\GuiVersion: "2.1"
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProxyName: ""
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ProxyPort: 0x00000000
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanPriority: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\DaysInterval: 0x00000007
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanDepth: 0x00000002
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\ScanSystemOnStartup: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\AutomaticallyUpdates: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\MinimizeOnStart: 0x00000000
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\BackgroundScan: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\BackgroundScanTimeout: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv8nj0eefc\LastTimeStamp: 0x00000104
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage: 0x00000001
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage: 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR: 0x00000000
HKEY_USERS\Control Panel\Colors\Background: "0 0 255"
HKEY_USERS\Control Panel\Desktop\SCRNSAVE.EXE: "C:\WINDOWS\System32\blphcr8nj0eefc.scr"
HKEY_USERS\Control Panel\Desktop\Wallpaper: "%WinDir%\System32\phcr8nj0eefc.bmp"
HKEY_USERS\Control Panel\Desktop\WallpaperStyle: "0"
HKEY_USERS\Control Panel\Desktop\OriginalWallpaper: "%WinDir%\System32\phcr8nj0eefc.bmp"
It connects with the following remote server:
-
antivirusxp-08.net
-------------------------------------------
This is an automatically generated description for Trojan Downloaders.
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
As it is trivial for the malware author to modify the Downloader to refer to a different website or web address, McAfee write detection routines for Downloaders which as a general rule do not include these strings in the detection routines.
This allows McAfee to write more generic detections for these threats and to proactively protect customers against future minor variants.
Therefore it is not possible to guarantee which website and/or port is being communicated with.
Also, as the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behaviour of these new binaries altered - possibly with every user infection.
Symptoms
Symptoms -
Many of these Downloaders install other malware including viruses as well as other Trojans.
Additionally many of them are used to remotely install Adware packages onto the affected host machine for the purposes of gaining referral revenue from the Adware software vendor.
Please note: If Adware is installed via a Downloader it may install it "cleanly" with the relevant uninstaller included for the user to terminate this Adware, although frequently this is not the case.
Method of Infection
Method of Infection -
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal -
Removal -
Use the latest Engine/Dats
Variants
Variants -
N/A
