KernelMode.info

PostPosted:**Wed Mar 16, 2011 2:29 am**

Is there anyone has new rogue "Windows Diagnostic" or "System Diagnostic"

thanks very much if you could post the sample here

PostPosted:**Wed Mar 16, 2011 1:33 pm**

E-Set Antivirus 2011

VT - http://www.virustotal.com/file-scan/rep ... 1300280043 0/40

AVG icon/E-Set (play on eset?) seems familiar.

edit : could not get to run in a vm or sandbox and I'm not able to use a real machine atm. If someone could show some screen that would be much appreciated :)

PostPosted:**Wed Mar 16, 2011 3:05 pm**

Meriadoc wrote:E-Set Antivirus 2011

Found a way to run this in a VM: create a file called "nvm.ch" at the folder of the dropper, %programfiles%\E-Set\, and %windir%\system32

Oh my... this FakeAV steals the AVG logo and interface, rips off ESET's name AND copies Norton and Panda (and probably BitDefender as well) to fill the web site

SCREENSHOTS:
Downloader:

Main window:

Security overview:

Annoy screens:

"... malicious backdoor Trojan that will cause complete chaos for both you and your computer."

Hijacks Internet Explorer, Firefox, Opera, Google Chrome and Safari via Image File Execution Options

Internet Explorer Emergency Mode:

WARNING: Visiting this web site may cause deja vu!
_hxxp://secure.zsecuritymall.com/

PostPosted:**Wed Mar 16, 2011 9:48 pm**

Meriadoc, sorry for the late response i've see your private message but i was busy :s
some additional informations

main:

Anti-analyzes (and just a tiny part):

badboy:

First key "=" is a launch protection and "<" mean the rogue is registered, another key defind also if we active the "Internet Explorer Emergency Mode" or if we deactive it but i was bored to search in the junk for find the good one.

Code: Select all

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\A88B44]
"fhgbcglanhmbignajg"="<"
"chacffld"="="

Serial to register: ABC12-DEF34-GHI56-JKL789
The original binary "setup.exe" make a copy of himself in \%systemroot%\System32 with the name "msiexecs.exe"

PostPosted:**Fri Mar 18, 2011 6:53 pm**

Windows Diagnostics will come out of this thread, last page, last post by markusg

http://www.kernelmode.info/forum/viewto ... 7&start=20

Re: Trojan.Advload

Postby markusg » Thu Mar 17, 2011 10:55 am

your_exe.rar
(26.83 KiB)

PostPosted:**Sat Mar 19, 2011 4:03 am**

CleanThis

CleanThis rogue
https://www.virustotal.com/file-scan/re ... 1300493133

PostPosted:**Sat Mar 19, 2011 4:06 am**

ThinkPoint remake?

PostPosted:**Sat Mar 19, 2011 10:56 am**

This is an older loader I believe will install what you want, I will grab the other identical looking loader off my test machine later today.

PostPosted:**Mon Mar 21, 2011 2:26 pm**

System Defender
(Installer from the new fake scan pages)

Only a .dll file. The file is hidden and works only with rundll32.exe

Screenshots:

PostPosted:**Mon Mar 21, 2011 2:31 pm**

Quick System Cleaner

Installer incl. Patch.
Homepage: hxxps://pcbug-repair.com/download.htm

Screenshot:

KernelMode.info

Rogue Antimalware (FakeAV, 2011 year)

FakeSysdef

E-Set Antivirus 2011

E-Set Antivirus 2011

Re: Rogue antimalware (FakeAV, FakeAlert)

Re: Malware Requests

CleanThis

Re: Rogue antimalware (FakeAV, FakeAlert)

Re: Malware Requests

System Defender

Quick System Cleaner