MD5: a3ed09d61f7622ec506e12f967ae06ba
SHA1: 8ef1c7ea9876138faae41b5051d67f9b13b850ed
SHA256: 02f32ffb7d007bbe98cdc536900ca36152ee4ba6bb3e89113de232fd08c7810c
SSDeep: 49152:CWfWfWzWnWfW4zUODUtMjZUvGB0dJtZ02wH99PBJh0efw:CWfWfWzWnWfW449WZUvGB0d102wH99PW
Size: 2024960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: ExpressInstaller
Created at: 2013-02-12 04:06:08

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Fake-AV. FakeAV programs generate exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.

Payload

No specific payload has been found.

Process activity

The FakeAV creates the following process(es):

a3ed09d61f7622ec506e12f967ae06ba.exe:1664

File activity

Registry activity

The process a3ed09d61f7622ec506e12f967ae06ba.exe:1664 makes changes in a system registry.
The FakeAV creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 20 CC 80 19 DB 41 B0 BC E4 D9 02 5A 3B 5B 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Screenshot

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate the original FakeAV process (How to End a Process With the Task Manager).
2. Delete the original Gen:Variant file.
   
3. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.