Submission Summary:

• Submission details:
• Submission received: 20 March 2009, 21:12:25
• Processing time: 8 min 3 sec
• Submitted sample:
• File MD5: 0x2F27EA45A515D7A294545B751DCFB62B
• File SHA-1: 0x3563A54062DA187321B6563C92AF1F2375F120ED
• Filesize: 3,342,336 bytes
• Alias:
• Troj/FakeVir-BJ [Sophos]
• Program:Win32/Winfixer [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
RogueAntiSpyware.VirusRemover2008	RogueAntiSpyware.VirusRemover2008 displays fake alerts in malware payloads in order to persuade users into buying the rogue antispyware product.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\VirusRemover2009\VirusRemover2009.lnk	709 bytes	MD5: 0xB924A8222FD72915A0BA680816317E06 SHA-1: 0x90F5827C1416CFF758E060AE2861B2CF54E4AB08	(not available)
2	%DesktopDir%\VirusRemover2009.lnk	697 bytes	MD5: 0xA2E1A080329A70986963BFBEB86598F7 SHA-1: 0xC58F621A7A915E361A897B48C325A6F9C5D2CE80	(not available)
3	%ProgramFiles%\VirusRemover2009\Viruses.bdt	122 bytes	MD5: 0x5A75F0A2C3FC1C68B47BD7DBC913E787 SHA-1: 0xA3350BFAA4DCFB48B4BA3FDE94B8D097A9CE0945	(not available)
4	%ProgramFiles%\VirusRemover2009\VRM2009.exe [file and pathname of the sample #1]	3,342,336 bytes	MD5: 0x2F27EA45A515D7A294545B751DCFB62B SHA-1: 0x3563A54062DA187321B6563C92AF1F2375F120ED	Troj/FakeVir-BJ [Sophos] Program:Win32/Winfixer [Microsoft]

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %CommonPrograms%\VirusRemover2009
• %ProgramFiles%\VirusRemover2009

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
VRM2009.exe	%ProgramFiles%\VirusRemover2009\VRM2009.exe	3,366,912 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	3,366,912 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2009
• HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2009
• HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}
• HKEY_CURRENT_USER\Software\VirusRemover2009
• HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform]
• 3P_UVSM 1.0.8.0 = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• VirusRemover2009 = "%ProgramFiles%\VirusRemover2009\VRM2009.exe"

so that VRM2009.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2009]
• DisplayName = "VirusRemover2009"
• UninstallString = "%ProgramFiles%\VirusRemover2009\uninstall.exe"
• NoModify = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2009]
• ExtraDomains = (zero-length binary value)
• BackupDomain = 64 65 73 6B 74 6F 70 72 65 70 61 69 72 70 61 63 6B 61 67 65 2E 63 6F 6D
• ActiveDomain = 64 65 73 6B 74 6F 70 72 65 70 61 69 72 70 61 63 6B 61 67 65 2E 63 6F 6D
• ActDomain = 64 65 73 6B 74 6F 70 72 65 70 61 69 72 70 61 63 6B 61 67 65 2E 63 6F 6D
• LicenseAccepted = 01
• Upd_size = 00 00 00 00
• InstallDate = D9 07 03 00 05 00 14 00 15 00 0C 00 38 00 F3 01
• ActivationCode = 31 39 46 36 45 37 42 31 2D 38 36 36 35 2D 34 34 39 32 2D 42 39 38 39 2D 44 39 37 42 34 43 43 37 34 34 36 44
• InfectionCount = 01 00 00 00
• LastScanTime = D9 07 03 00 05 00 14 00 15 00 0E 00 17 00 8F 02
• TotalScanCount = 02 00 00 00
• [HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
• Version = 33 50 5F 56 53 4D
• [HKEY_CURRENT_USER\Software\VirusRemover2009]
• scns_time = 59 77 C4 49 00 00 00 00

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Ukraine
	Russian Federation

• To mark the presence in the system, the following Mutex objects were created:
• AntiMalwareMaster3B6870C4-797E-480a-8A36-26DA4E308875
• AntiMalwareMasterAntiMalwareMaster242924B7-C836-49b8-8572-1E91922CA594

• The data identified by the following URLs was then requested from the remote web server:
• http://windowsupdate.microsoft.com/
• http://flog.desktoprepairpackage.com
• http://flog.pcsolutionshelp.com
• http://flog.realiableadvisorycenter.com
• http://flog.servicetoolstore.com
• http://flog.servicenetworktool.com
• http://flog.toolswebstorage.com
• http://flog.advancesoftwaresolutions.com
• http://flog.softwareinstallpack.com
• http://flog.advancesoftwaretool.com
• http://desktoprepairpackage.com
• http://pcsolutionshelp.com
• http://realiableadvisorycenter.com
• http://servicetoolstore.com
• http://servicenetworktool.com
• http://toolswebstorage.com
• http://advancesoftwaresolutions.com
• http://softwareinstallpack.com
• http://advancesoftwaretool.com
• http://flog.desktoprepairpackage.com/?action=38&pc_id=525497056&abbr=3P_UVSM_5712_8.0
• http://flog.desktoprepairpackage.com/?action=18&pc_id=525497056&abbr=3P_UVSM_5712_8.0
• http://flog.desktoprepairpackage.com/?action=39&pc_id=525497056&abbr=3P_UVSM_5712_8.0
• http://flog.desktoprepairpackage.com/?action=5&pc_id=525497056&abbr=3P_UVSM_5712_8.0