Troj/FakeAV-BAB is a Trojan for the Windows platform.
Troj/FakeAV-BAB includes functionality to:
- run automatically
- steal confidential information
- access the internet and communicate with a remote server via HTTP
Troj/FakeAV-BAB communicates via HTTP with the following locations:
info-protector . com
When Troj/FakeAV-BAB is installed it creates the file <User>\Local Settings\Application Data\umbddo\tesisftav.exe.
The following registry entries are created to run tesisftav.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nhcfgdoy
<User>\Local Settings\Application Data\umbddo\tesisftav.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
nhcfgdoy
<User>\Local Settings\Application Data\umbddo\tesisftav.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer\Download
RunInvalidSignatures
0x00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
SaveZoneInformation
0x00000001
HKCU\Software\Microsoft\Internet Explorer\Download
CheckExeSignatures
no
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
LowRiskFileTypes
.exe
Registry entries are created under:
HKLM\SOFTWARE\avsoft
HKCU\Software\Microsoft\Windows Script
HKCU\Software\avsoft