TROJ_SCARECROW.A

Installation

Fügt die folgenden Ordner hinzu:

• %Windows%\PCHEALTH\AutoClean

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Fügt die folgenden Prozesse hinzu:

• explorer.exe

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
AutoProtect = %Windows%\pchealth\AutoClean\AutoProtect.vbs

Verbreitung

Die besagte .INF-Datei enthält die folgenden Zeichenfolgen:

[autorun]
icon=%SystemRoot%\system32\SHELL32.dll,7
open=AutoClean\shh.bat
action=Virus Protection by Scarecrow(The Mick)
shell\open\command=AutoClean\shh.bat

Einschleusungsroutine

Schleust die folgenden Dateien ein:

• %Windows%\pchealth\AutoClean\AutoProtect.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\autorun.inf - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\call.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\ComboKill.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\invis.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Replicate.vbs - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\shh.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Patch\PatchIt.bat - also detected as TROJ_SCARECROW.A
• %Windows%\pchealth\AutoClean\Patch\update003.bat - also detected as TROJ_SCARECROW.A

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Setzt die Attribute der eingeschleusten Dateien wie folgt:

• Read-Only, Hidden, and System

Andere Details

Ausgehend von der Analyse des Codes verfügt die Malware über die folgenden Fähigkeiten:

• Drops the following files in the root directory of the drive where it was executed: autorun.inf - also detected as TROJ_SCARECROW.A ComboKill.bat - also detected as TROJ_SCARECROW.A AutoClean\AutoProtect.vbs - also detected as TROJ_SCARECROW.A AutoClean\ComboKill.bat - also detected as TROJ_SCARECROW.A AutoClean\Replicate.vbs - also detected as TROJ_SCARECROW.A AutoClean\shh.bat - also detected as TROJ_SCARECROW.A It checks if the following files exist, most of which are related to other malware:
  
  • %Windows%\System\lsas.exe
  • %User Profile%\lsass.exe
  • %Windows%\Tasks\Scvhost.exe
  • {drive letter}\RECYCLER {drive letter}\New.exe
  • {drive letter}\start.exe

  If it finds matches, it terminates the process, remove the attributes, Read-only, Hidden, and System of the file, then deletes the associated files and registries. Below is the list of files:
  

  • %Windows%\System\lsas.exe
  • C:\Documents and Settings\Administrator\lsass.exe
  • %User Profile%\lsass.exe %Windows%\Tasks\Scvhost.exe
  • C:\New.exe %Windows%\Tasks\Scvhost.exe %Windows%\System\bs.pif
  • {drive letter}\RECYCLER {drive letter}\autorun.inf
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Autorunme.exe
  • {drive letter}\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213
  • {drive letter}\RECYCLER {drive letter}\New.exe {drive letter}\start.exe

  Below is the list of registry entries:
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  Windows Logistics=

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  LSA Shellu=

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  Load=

  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  BackBitmapIE5=

  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  BackBitmapShell=

(Hinweis: %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000, XP und Server 2003.)