09 march, 2010
VirusProtector
Updated: March 8, 2010 4:19:59 PM
Type: Misleading Application
Name: VirusProtector
Version: 1.0.0.1
Risk Impact: Medium
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
SUMMARY
Behavior
VirusProtector is a misleading application that may give exaggerated reports of threats on the computer.Protection
- Initial Rapid Release version March 8, 2010 revision 016
- Latest Rapid Release version March 8, 2010 revision 016
- Initial Daily Certified version March 8, 2010 revision 033
- Latest Daily Certified version March 8, 2010 revision 033
- Initial Weekly Certified release date March 10, 2010
TECHNICAL DETAILS
BehaviorThe program must be manually installed.
It can be downloaded from the following location:
[http://]antivpc.com
The program reports false or exaggerated system security threats on the computer.
Fake Detection Names
The program may falsely report detections of the following threats:
The user is then prompted to pay for a full license of the application in order to remove the threats.
The program may also display the following fake error messages:
Installation
When the program is executed, it creates the following folder:
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012010030820100309
It also creates the following files:
- C:\WINDOWS\Prefetch\1.EXE-335C5EEA.pf
- C:\WINDOWS\system32\drivers\[RANDOM FILE NAME].exe
- C:\WINDOWS\system32\drivers\[RANDOM FILE NAME].dll
- C:\WINDOWS\system32\[RANDOM FILE NAME].exe
- C:\WINDOWS\system32\[RANDOM FILE NAME].dll
- C:\WINDOWS\[RANDOM FILE NAME].exe
- C:\WINDOWS\[RANDOM FILE NAME].dll
Next, the program deletes the following folders:
- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008011620080117
- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008011720080118
It also deletes the following file:
C:\Documents and Settings\Administrator\Local Settings\Temp\Perflib_Perfdata_e38.dat
The program then modifies the following files:
- C:\Documents and Settings\Administrator\Cookies\index.dat
- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
- C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\Administrator\ntuser.dat.LOG
- C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
- C:\WINDOWS\Prefetch\PERL.EXE-08A6F3BE.pf
- C:\WINDOWS\Prefetch\REGSHOT.EXE-2A173C98.pf
- C:\WINDOWS\system32\config\software.LOG
- C:\WINDOWS\system32\config\system.LOG
Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shelly" = "Explorer.exe"
It also creates the following registry entries:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\"EnableLUA" = "0"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\"LoadAppInit_DLLs" = "1"
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\"C:\INF\1.exe" = "VirusProtector Application"
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\"HRZR_EHACNGU:P:\VAS\1.rkr" "1B 00 00 00 06 00 00 00 A0 F0 A0 6C C2 BE CA 01"
The program then creates the following registry subkey:
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012010030820100309
Next, the program deletes the following registry subkeys:
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012008011620080117
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012008011720080118
It may then modify the following registry entries:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\"Directory" = "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\"Directory" = "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\"CachePath" = "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\"CachePath" = "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2\"CachePath" = "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2\"CachePath" = "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3\"CachePath" = "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3\"CachePath" = "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4\"CachePath" = "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4\"CachePath" = "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSYCLM\"Start" = "0x389F0129"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSYCLM\"Start" = "0x8824EF45"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\"AppInit_DLLs" = ""
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\"AppInit_DLLs" = "aLslnAJQD.dll"
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\"HRZR_EHACNGU" = "1A 00 00 00 A6 01 00 00 90 50 33 F9 94 00 CA 01"
- HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\"HRZR_EHACNGU" = "1B 00 00 00 A7 01 00 00 B0 A6 9E 6C C2 BE CA 01"