Your PC is infected

As discussed in more detail in [1], the initial vector of this trojan arrives in an email message, typically disguised as an advertisement for pornographic content (Figure 3). The message contains a small amount of text and a hyperlink.

Figure 3. The bait.

Clicking on the link leads to a web page displaying the common codec error message and offering the user the opportunity to download an update (Figure 4). This primitive form of social engineering appears to be sufficient for the trojan’s needs – the websites are equipped to host code distribution kits such as Mpack, but it seems it has not proved necessary to bring in the heavy artillery.

Figure 4. The hook.

On clicking on the ‘Continue’ button the fake codec is downloaded as view.exe. Once the executable has been downloaded, it deploys an arsenal of psychological warfare to scare the user into paying for the full ‘product’.

View.exe is a rather simple downloader. The code is somewhat obfuscated, but its real purpose is to attempt to download three executables from a website (which at the time of writing is no longer live):

The first, scan4.exe, is the next stage of the FakeAlert scam. Interestingly, sl32.exe is an Exchanger variant (aka Srizbi – see VB, November 2007, p.5) – I don’t believe it is a coincidence that there is a connection between the spammed FakeAlert variants and one of the world’s largest botnets. We have not yet found an active instance of the gpls32.exe file.

Scan4.exe is essentially a dropper, which drops and installs the ‘nagger’ component. This is dropped into the %SYSTEM% folder as ‘braviax.exe’ (occasionally as ‘buritos.exe’), and registers for startup under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “” = C:\WINDOWS\System32\braviax.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “” = C:\WINDOWS\System32\ braviax.exe

Figure 5. First warning: bubble.

Braviax.exe opens a notify bubble on the taskbar which claims that the system is infected (Figure 5). If the user clicks on the bubble, the trojan will download the next component into %system%winivstr.exe and execute it. It uses the following URL list to download this component:

Additionally, a rootkit component is dropped onto the system as %SYSTEM%\drivers\figaro.sys (with copies named ‘beep.sys’ in the same folder and in the dllcache folder). This is responsible for terminating a large list of security-product-related processes, and rehooking its components (braviax.exe and karina.dat) in the registry; the first in HKLM\Software\Microsoft\Windows\CurrentVersion\Run and the second one as an Appinit_DLL, making it difficult to remove the complex. Interestingly, if buritos.exe is executed, the Run key is removed (but not the Appinit_DLL).

This is the point at which the real psychological warfare begins.

The downloaded third executable stage changes the desktop background to display a large malware warning dialog similar to that shown in Figure 6.

Figure 6. Second warning: your desktop is infected.

If the user falls for the scam at this point and chooses to download the full product the URL accessed will be similar to the following:

http://av-xp2008.com/images/*/3a35c64942d7aa9dec056277e50741da/*.gif

(* represents random values)

However, some users will ignore this warning, so in addition, the screensaver is set to the ‘blue screen’ screensaver from Sysinternals, which also mimics a reboot process (Figure 7).

Figure 7. Third warning: blue screen.

Our support department received numerous calls from customers complaining that their computer had landed in a continuous crash-reboot stage. In reality, it was this screensaver fooling them.

A VBS script is also dropped and executed, which removes all the system restore points. This disables the trivial removal method, which would be to revert to a known safe restore point before the infection occurred.

Generally, the malware warning and the blue screen prove more than sufficient to break down the user’s resistance and persuade them to download the recommended application (‘VirusRemover2008’ at the time of collecting the material for this article, but the name of the product is subject to frequent change). Once downloaded, the application claims to find a handful of spyware and trojan instances on the system.

Figure 8. Infection is found on the system.

Needless to say, this is also the case when run on a clean, freshly installed virtual machine without Internet connectivity. So unless we believe that Microsoft ships trojans with its Windows XP installer packs (we don’t), the claims are false.

In some of the scam AV product installations, legitimate anti-virus data files are downloaded from legitimate locations. Matters took an interesting turn when a company, having earlier been identified as being responsible for one of these scam attempts, approached VirusBuster, making enquiries about licensing our scan engine. Of course, we refused them.

From a support point of view, we receive numerous complaints as a result of the scamware. First, it ‘detects’ infected files on the system that our product has not detected (because they do not really exist on the system). Then, because the users get infected over and over again with the ‘same’ scamware (what the average user is not expected to realize is that, despite having the same application name, the executables behind the scamware change frequently). Finally, when it comes to removing the malicious files, the protecting rootkit component makes it more difficult than usual.

Fake security products and all the malicious components that go along with them to run the schemes have been appearing at a steady pace over recent months. They may not appear in the top half of our prevalence lists, but they are forever burnt into the memories of our user base.

Overall, nothing extremely malicious has happened during the process (if we ignore the fact that the infected PC has been connected to the Srizbi botnet), only a little nuisance. Nothing personal, just business.