Analysis by: JessaD
 OVERALL RISK RATING:
 REPORTED INFECTION:

  • Threat Type:

  • Destructiveness:

  • Encrypted:

  • In the wild:

  OVERVIEW

This Trojan arrives via SMS messages.

  TECHNICAL DETAILS

Arrival Details

This Trojan arrives via SMS messages that contain the following details:

erfs

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

u
r = tr

It adds the following registry entries to enable its automatic execution at every system startup:

hklm
run = a.exe

Other System Modifications

This Trojan adds the following registry keys:

q
q = q

  SOLUTION

Step 1

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer"s registry.

DATA_GENERIC_KEY_SHELL_1
  • In the right panel, locate the registry value:
    Default
  • Check whether its value data is the path and file name of the malware/grayware/spyware file.
  • If the value data is the malware/grayware/spyware file, right-click the Default key and choose Modify to change its value.
  • In the Value data input box, delete the existing value and type the default value:
    %1 %*
  • Repeat this procedure for the following registry key(s):
    • DATA_GENERIC_KEY_SHELL
  • Close Registry Editor.
  • Click Start>Run, then type:
    command /c del regedit.com
  • Press Enter.

    • Step 2

    Download and apply this security patch Refrain from using these products until the appropriate patches have been installed. Trend Micro advises users to download critical patches upon release by vendors.


    Did this description help? Tell us how we did.