Submission Summary:

• Submission details:
• Submission received: 12 December 2008, 11:07:50
• Processing time: 5 min 52 sec
• Submitted sample:
• File MD5: 0xC6E13569FD919F11C87FEB2998D7E103
• File SHA-1: 0x7374BD5FCA94184AC41DC3FC3C7BDB789BC2C785
• Filesize: 894,928 bytes
• Alias:
• VirusRemover2008 [Symantec]
• not-a-virus:FraudTool.Win32.VirusRemover.ac [Kaspersky Lab]
• Winfixer [McAfee]
• Troj/FakeVir-BJ [Sophos]
• Generic.Win32.Malware.WinFixer [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\VirusRemover2008\VirusRemover2008.lnk	709 bytes	MD5: 0x5C4FDAE99AA21DD6522E5BA90A837A90 SHA-1: 0x73B5067CC4AC6F26D249FC6DB918E6502A21BFDB	(not available)
2	%DesktopDir%\VirusRemover2008.lnk	697 bytes	MD5: 0x28417516DC82F94BCE3CCCFC361576C9 SHA-1: 0xF0F560967DAC4E01542CCD437749AA1C6089933B	(not available)
3	%ProgramFiles%\VirusRemover2008\VRM2008.exe [file and pathname of the sample #1]	894,928 bytes	MD5: 0xC6E13569FD919F11C87FEB2998D7E103 SHA-1: 0x7374BD5FCA94184AC41DC3FC3C7BDB789BC2C785	VirusRemover2008 [Symantec] not-a-virus:FraudTool.Win32.VirusRemover.ac [Kaspersky Lab] Winfixer [McAfee] Troj/FakeVir-BJ [Sophos] Generic.Win32.Malware.WinFixer [Ikarus]

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %CommonPrograms%\VirusRemover2008
• %ProgramFiles%\VirusRemover2008

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	3,223,552 bytes
VRM2008.exe	%ProgramFiles%\VirusRemover2008\VRM2008.exe	3,223,552 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2008
• HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2008
• HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}
• HKEY_CURRENT_USER\Software\VirusRemover2008
• HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform]
• 3P_UVRM 1.0.22.0 = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• VirusRemover2008 = "%ProgramFiles%\VirusRemover2008\VRM2008.exe"

so that VRM2008.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2008]
• DisplayName = "VirusRemover2008"
• UninstallString = ""%ProgramFiles%\VirusRemover2008\VRM2008.exe" -uninstall"
• NoModify = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2008]
• LicenseAccepted = 01
• Upd_size = 00 00 00 00
• InstallDate = D8 07 0A 00 00 00 13 00 12 00 2C 00 21 00 D4 01
• ActivationCode = 31 33 42 37 30 46 44 46 2D 36 45 35 43 2D 34 35 39 31 2D 42 34 30 41 2D 38 32 46 38 36 35 45 36 45 36 36 44
• UpdateEnabled = 01
• InfectionCount = 00 00 00 00
• LastScanTime = D8 07 0A 00 00 00 13 00 12 00 2D 00 3A 00 C5 01
• TotalScanCount = 02 00 00 00
• [HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
• Version = 33 50 5F 56 52 4D
• [HKEY_CURRENT_USER\Software\VirusRemover2008]
• scns_time = 82 E2 FB 48 00 00 00 00

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex objects were created:
• AntiMalwareMaster8E0C904E-85D5-4fd8-9473-D173D4D31A9F
• AntiMalwareMaster0385D3B8-0B69-4247-BE5E-32C6591CCD3A

• The data identified by the following URLs was then requested from the remote web server:
• http://windowsupdate.microsoft.com/
• http://flog.bestvirusremover2008.com/?action=38&pc_id=525497056&abbr=3P_UVRM_5712_22.0
• http://flog.bestvirusremover2008.com/?action=18&pc_id=525497056&abbr=3P_UVRM_5712_22.0
• http://flog.bestvirusremover2008.com/?action=39&pc_id=525497056&abbr=3P_UVRM_5712_22.0
• http://flog.bestvirusremover2008.com/?action=5&pc_id=525497056&abbr=3P_UVRM_5712_22.0