ThreatExpert Report: not-a-virus:FraudTool.Win32.VirusProtectPro.ad, VirusHeat, FakeAlert-AF..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 14 August 2008, 22:06:33
Processing time: 5 min 22 sec
Submitted sample:

File MD5: 0x88FCBFEAF0F3068CB0D758C1FCFB96BA
File SHA-1: 0xCCF4D02097EF239E8FFB2BCD8633B031B962907A
Filesize: 2,167,502 bytes
Alias:

VirusHeat [Symantec]
not-a-virus:FraudTool.Win32.VirusProtectPro.ad [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
RogueAntiSpyware.VirusProtect_Pro	VirusProtect Pro is a Rogue AntiSpyware product which comes bundled along with a malicious downloader. It is downloaded and installed without the users consent. It also uses deceptive advertising to convince users to purchase their product.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\VirusHeat 4.3.lnk %StartMenu%\VirusHeat 4.3.lnk	744 bytes	MD5: 0x30313BA5488DC54DB02417E4CE64E73F SHA-1: 0x6AF5A6624254EBD1F00782AD9AE883D1E2769EC9	(not available)
2	%Temp%\vht.dat	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41	(not available)
3	%Programs%\VirusHeat 4.3\Uninstall VirusHeat 4.3.lnk	541 bytes	MD5: 0xD8D48334BFA3A21D6B3BCA17F4D58E48 SHA-1: 0x8E49695EF0FF4FF158CF39988ADE6605A2FC6395	(not available)
4	%Programs%\VirusHeat 4.3\VirusHeat 4.3 Website.lnk	555 bytes	MD5: 0x8843AEC7280C6154FFC5BF0C697C2D95 SHA-1: 0xD5B9B6218663DD48808A1C7836ABA64E15B546D5	(not available)
5	%Programs%\VirusHeat 4.3\VirusHeat 4.3.lnk	756 bytes	MD5: 0xE4237B93EA2C3A33A6B8397BA65AFD00 SHA-1: 0x1E7D10D4C469D3547A672DE29F6555F92CF2EE4B	(not available)
6	%ProgramFiles%\VirusHeat 4.3\blacklist.txt	50,527 bytes	MD5: 0x00372593B3438D9E475AF653E582A4C6 SHA-1: 0xB3B73A2D55D41ED9743D10B1D58D66CF49E0BBD2	(not available)
7	%ProgramFiles%\VirusHeat 4.3\Lang\English.ini	32,738 bytes	MD5: 0xE6141A8192372E7B135265DAA2A5A8FE SHA-1: 0x9C0E865EC7AEEE14F1CC008A1C16D75DB14EC376	(not available)
8	%ProgramFiles%\VirusHeat 4.3\msvcp71.dll	499,712 bytes	MD5: 0x561FA2ABB31DFA8FAB762145F81667C2 SHA-1: 0xC8CCB04EEDAC821A13FAE314A2435192860C72B8	(not available)
9	%ProgramFiles%\VirusHeat 4.3\msvcr71.dll	348,160 bytes	MD5: 0x86F1895AE8C5E8B17D99ECE768A70732 SHA-1: 0xD5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA	(not available)
10	%ProgramFiles%\VirusHeat 4.3\uninst.exe	41,209 bytes	MD5: 0x5B46B97A73432A25D43E6948AB729336 SHA-1: 0x3A43B9FEDF253E4EBF33615189299560A2C3B950	(not available)
11	%ProgramFiles%\VirusHeat 4.3\vht.dat	351,696 bytes	MD5: 0x229A4C028DA4BF9D25384C9A868B7049 SHA-1: 0xAD88837E72646C54A0C54342C00698697A470BF0	(not available)
12	%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.exe	1,757,184 bytes	MD5: 0x9500DE7AD3E1F18201ADFC1857894437 SHA-1: 0x268643FBEE42D10D63E4063A958513B6D21A2201	VirusHeat [Symantec] not-a-virus:FraudTool.Win32.VirusProtectPro.ad [Kaspersky Lab] FakeAlert-AF [McAfee] Program:Win32/SpyAxe [Microsoft]
13	%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.url	50 bytes	MD5: 0x268CD62E3F4B09EC84D2FAA3EE428D2E SHA-1: 0x91CA588A5DDBA13401CEEB618ED2FECB53B98092	(not available)
14	[file and pathname of the sample #1]	2,167,502 bytes	MD5: 0x88FCBFEAF0F3068CB0D758C1FCFB96BA SHA-1: 0xCCF4D02097EF239E8FFB2BCD8633B031B962907A	VirusHeat [Symantec] not-a-virus:FraudTool.Win32.VirusProtectPro.ad [Kaspersky Lab]

Notes:

%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%StartMenu% is a variable that refers to the file system directory containing Start menu items. A typical path is C:\Documents and Settings\[UserName]\Start Menu.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\VirusHeat 4.3
%ProgramFiles%\VirusHeat 4.3
%ProgramFiles%\VirusHeat 4.3\Lang
%ProgramFiles%\VirusHeat 4.3\Logs
%ProgramFiles%\VirusHeat 4.3\Quarantine

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
VirusHeat 4.3.exe	%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.exe	4,042,752 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	204,800 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\Version]

(Default) = "0.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\TypeLib]

(Default) = "{97d25db0-0363-11cf-abc4-02608c9e7553}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\ProgID]

(Default) = "OctetList"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}\InprocServer32]

(Default) = "adsnds.dll"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}]

(Default) = "ADs OctetList Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14E6D991-DB22-4661-981D-20C168D6847B}]

(Default) = "ILog"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2242513C-F5E9-41B3-BC89-4D9DAF487450}]

(Default) = "IThreatEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B489B37-FC1B-45C8-B1CE-78D9AEF5B336}]

(Default) = "IQuarantineEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D6A6E24-FDFF-418E-A93D-9FBDCBA377AF}]

(Default) = "IBackup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E318E44-0C35-4292-AF91-18DD17795636}]

(Default) = "ISearchItem"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{495349A3-3A35-465F-88DF-6CCFC1348246}]

(Default) = "IThreat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{575E8879-D6CF-4992-A7FE-651DA9277BCB}]

(Default) = "IScannerEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76A15001-FF88-47EE-9E34-9F68E34246AF}]

(Default) = "ILogRecord"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{819A1C55-735F-4696-8727-3772EC87AD26}]

(Default) = "IIgnoreList"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DC7E656-FFBC-4BA2-AF81-1C6C4FE04407}]

(Default) = "IQuarantine"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A86BED71-2B56-4778-9C48-829A3D01C687}]

(Default) = "IThreatCollectionEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE119E11-CF86-43CB-91AA-1ACF2BBF9EC6}]

(Default) = "ILogEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5A1CE7F-011D-4475-98DB-076AAF3B1D18}]

(Default) = "IThreatCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B667F141-171C-4AC6-BD2B-8E0C646FB920}]

(Default) = "IEngineListener"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA4F8351-05EF-4956-B9AB-1093B732436F}]

(Default) = "IRunAs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\TypeLib]

(Default) = "{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1E4E46D-53B8-45DC-ABF0-3E7ADEF79012}]

(Default) = "IPaths"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\0\win32]

(Default) = "%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\VirusHeat 4.3\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{83B0CADC-EA64-4AC6-822A-3ECE95F44DA6}\1.0]

(Default) = "AVG 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

VirusHeat 4.3 = ""%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.exe" /h"

so that VirusHeat 4.3.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3]

DisplayName = "VirusHeat 4.3"
UninstallString = "%ProgramFiles%\VirusHeat 4.3\uninst.exe"
DisplayIcon = "%ProgramFiles%\VirusHeat 4.3\VirusHeat 4.3.exe"
DisplayVersion = "4.3"
NSIS:StartMenuDir = "VirusHeat 4.3"
URLInfoAbout = "http://www.virusheat.com"
Publisher = "virusheat.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = 45 AA A2 74 B9 0D 1F FF FF FF FF 9D C6 25 CF 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

To mark the presence in the system, the following Mutex objects were created:

DBWinMutex
RAL72423988
72423988::WK
VirusHeat_MUTEX

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
www.virusheat.com	80	(null)	(null)

The following GET requests were made:

db/dbver.dat
db/vht.dat

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%ProgramFiles%\virusheat 4.3\virusheat 4.3.exe

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.