ThreatExpert Report: RogueAntiSpyware.AdvancedAntivirus, not-a-virus:FraudTool.Win32.MSAntivirus.ak..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 18 December 2008, 17:29:10
Processing time: 6 min 40 sec
Submitted sample:

File MD5: 0x4564D990235D776B1CB8A3746C286CFF
File SHA-1: 0xF739023EE5C2B2CA02FA4DB1F4F386B0E4D7B18A
Filesize: 1,052,373 bytes
Alias:

RogueAntiSpyware.AdvancedAntivirus [PCTools]
not-a-virus:FraudTool.Win32.MSAntivirus.ak [Kaspersky Lab]
Generic.Win32.Malware.Antivirus2008 [Ikarus]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
RogueAntiSpyware.AdvancedAntivirus	RogueAntispyware.AdvancedAntivirus is another fake antispyware that tries to get money from users by prompting them to register and buy their products.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\Micro Antivirus.lnk	698 bytes	MD5: 0x3BC9115C6123C7EED982A3169972251C SHA-1: 0xF1F922F12C7FF7107E4669DDECA2750E1F53818D	(not available)
2	%ProgramFiles%\MicroAV\MicroAV.cpl %System%\MicroAV.cpl	166,400 bytes	MD5: 0x539C641819F3DCB8EF79BCBF1D829E7A SHA-1: 0xA0C959197E25126B82BD8899D0619C3B4ADD7DBF	AntiVirus2009 [Symantec] not-a-virus:FraudTool.Win32.UltimateAntivirus.cq [Kaspersky Lab] FakeAlert-AB [McAfee] Mal/FakeAV-F [Sophos] Trojan:Win32/FakeSecSen [Microsoft] Generic.Win32.Malware.Antivirus2008 [Ikarus]
3	%ProgramFiles%\MicroAV\MicroAV.exe	407,040 bytes	MD5: 0x18B8244ABB90AD457729DC932B96A80F SHA-1: 0xEB75FD2B569FB08037A7A19BB20F7295068157F7	AntiVirus2009 [Symantec] not-a-virus:FraudTool.Win32.MSAntivirus.ak [Kaspersky Lab] FakeAlert-AB [McAfee] Troj/FakeAle-HT [Sophos] Trojan:Win32/FakeSecSen [Microsoft] Virus.Win32.FakeAlert.S [Ikarus]
4	%ProgramFiles%\MicroAV\MicroAV.ooo	1 bytes	MD5: 0xCFCD208495D565EF66E7DFF9F98764DA SHA-1: 0xB6589FC6AB0DC82CF12099D1C2D40AB994E8410C	(not available)
5	%ProgramFiles%\MicroAV\MicroAV0.dat	410,880 bytes	MD5: 0xBBE8E02DB2597E6D9D874718AE5639A8 SHA-1: 0x8BF63E606A06AD3A041C438A2EB8E8107198CBC7	Trojan:Win32/FakeSecSen [Microsoft] Trojan.Fakealert.ACZ [Ikarus]
6	%ProgramFiles%\MicroAV\MicroAV1.dat	33,868 bytes	MD5: 0x8444545DC7705D6CE6D0CB55BD7A9D4F SHA-1: 0xB140432FB8DA6E99529CDAEEFB404BC36CE9D525	RogueAntiSpyware.AdvancedAntivirus [PCTools] AntiVirus2008 [Symantec] Trojan:Win32/FakeSecSen [Microsoft] Generic.Win32.Malware.FakeSecSen [Ikarus]
7	[file and pathname of the sample #1]	1,052,373 bytes	MD5: 0x4564D990235D776B1CB8A3746C286CFF SHA-1: 0xF739023EE5C2B2CA02FA4DB1F4F386B0E4D7B18A	RogueAntiSpyware.AdvancedAntivirus [PCTools] not-a-virus:FraudTool.Win32.UltimateAntivirus.cq, not-a-virus:FraudTool.Win32.MSAntivirus.ak [Kaspersky Lab] Generic.Win32.Malware.Antivirus2008 [Ikarus]

Notes:

%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%ProgramFiles%\MicroAV

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
MicroAV.exe	%ProgramFiles%\MicroAV\MicroAV.exe	655,360 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	155,648 bytes

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\MicroAV

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

ANTIVIRUS = "%ProgramFiles%\MicroAV\MicroAV.exe"

so that MicroAV.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

ANTIVIRUS = "%ProgramFiles%\MicroAV\MicroAV.exe"

so that MicroAV.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\MicroAV]

004 = 0x00000001
111 = 0x0095218F
545 = "%ProgramFiles%\MicroAV\MicroAV.exe"
546 = "0"

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

To mark the presence in the system, the following Mutex object was created:

_SHuassist.mtx

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.