Gen:Variant.Strictor.4450 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Gen:Variant.Strictor.4450 (B) (Emsisoft), Artemis!A3ED09D61F76 (McAfee), Trojan.Win32.FakeAV (Ikarus), Gen:Variant.Strictor.4450 (FSecure)Behaviour: Trojan, Fake-AV
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a3ed09d61f7622ec506e12f967ae06ba
SHA1: 8ef1c7ea9876138faae41b5051d67f9b13b850ed
SHA256: 02f32ffb7d007bbe98cdc536900ca36152ee4ba6bb3e89113de232fd08c7810c
SSDeep: 49152:CWfWfWzWnWfW4zUODUtMjZUvGB0dJtZ02wH99PBJh0efw:CWfWfWzWnWfW449WZUvGB0d102wH99PW
Size: 2024960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: ExpressInstaller
Created at: 2013-02-12 04:06:08
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse). Fake-AV. FakeAV programs generate exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The FakeAV creates the following process(es):
a3ed09d61f7622ec506e12f967ae06ba.exe:1664
File activity
Registry activity
The process a3ed09d61f7622ec506e12f967ae06ba.exe:1664 makes changes in a system registry.
The FakeAV creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 20 CC 80 19 DB 41 B0 BC E4 D9 02 5A 3B 5B 0F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
Network activity (URLs)
No activity has been detected.
Rootkit activity
No anomalies have been detected.
Screenshot
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate the original FakeAV process (How to End a Process With the Task Manager).
- Delete the original Gen:Variant file.
- Reboot the computer.