EKerberos

Behavior
The program must be manually installed.



The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the threats.





Installation
When the program is executed, it creates the following files:

• C:\Documents and Settings\All Users\Desktop\eKerberos.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\eKerberos\Register eKerberos.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\eKerberos\Start eKerberos.lnk
• %ProgramFiles%\eKerberos\eKerberos.exe
• %ProgramFiles%\eKerberos\Hook.dll
• %ProgramFiles%\eKerberos\RES\Skin\background.caution.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.clock.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.demomode.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.demonotice.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.options.registration.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.options.settings.bmp
• %ProgramFiles%\eKerberos\RES\Skin\background.registration.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buylong.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buylong.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buylong.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buylong.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buyshort.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buyshort.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buyshort.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\buyshort.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancellong.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancellong.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancellong.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancellong.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancelshort.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancelshort.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\cancelshort.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\checkbox.checked.bmp
• %ProgramFiles%\eKerberos\RES\Skin\checkbox.unchecked.bmp
• %ProgramFiles%\eKerberos\RES\Skin\close.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\close.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\close.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\close.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\closeapp.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\closeapp.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\closeapp.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\closeapp.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\deny.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\deny.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\deny.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\deny.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\oklong.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\oklong.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\oklong.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\oklong.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\okshort.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\okshort.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\okshort.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\permit.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\permit.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\permit.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\permit.pressed.bmp
• %ProgramFiles%\eKerberos\RES\Skin\registration.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\registration.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\risk.normal.grey.bmp
• %ProgramFiles%\eKerberos\RES\Skin\risk.normal.red.bmp
• %ProgramFiles%\eKerberos\RES\Skin\settings.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\settings.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\switch.active.bmp
• %ProgramFiles%\eKerberos\RES\Skin\switch.deactive.bmp
• %ProgramFiles%\eKerberos\RES\Skin\switch.normal.bmp
• %ProgramFiles%\eKerberos\RES\Skin\switch.pressed.bmp
• %ProgramFiles%\eKerberos\SkinActive.xml
• %ProgramFiles%\eKerberos\uninstall.exe

Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eKerberos" = "C:\Program Files\eKerberos\eKerberos.exe"

It also creates the following registry subkeys:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eKerberos
• HKEY_LOCAL_MACHINE\SOFTWARE\eKerberos

Summary