MalwarePro

This program is usually downloaded while surfing or downloading files from a malicious Web site. It can also arrive bundled with other Adware or Spyware applications.

Behavior
The program must be manually installed.

The program shows the following Graphical User Interface (GUI) and prompts the user to perform a system scan:




The program then reports false or exaggerated system security threats on the computer.



The user is then prompted to pay for a full license of the application in order to remove the errors.





Installation
When the program is executed, it creates the following files:
%UserProfile%\Desktop\MalwarePro.lnk
%UserProfile%\Start Menu\Programs\MalwarePro\MalwarePro.lnk
%UserProfile%\Start Menu\Programs\MalwarePro\Uninstall MalwarePro.lnk
%ProgramFiles%\MalwarePro\MalwarePro.exe
%ProgramFiles%\MalwarePro\Uninstall\IRIMG1.JPG
%ProgramFiles%\MalwarePro\Uninstall\IRIMG2.JPG
%ProgramFiles%\MalwarePro\Uninstall\IRIMG3.JPG
%ProgramFiles%\MalwarePro\Uninstall\uninstall.dat
%ProgramFiles%\MalwarePro\Uninstall\uninstall.xml
%Windìr%\MalwarePro\uninstall.exe
%Windìr%\MalwarePro Setup Log.txt

It then creates the following registry subkeys:
HKEY_CURRENT_USER\Software\MPMFC1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwarePro5.2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\MalwarePro
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\MalwarePro

It also creates the following registry subkey so that it executes whenever Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MalwareProMFC

Summary