TROJ_CRYPTER.A

Malware type: Trojan

Aliases: SysCenter (McAfee), Trojan Horse (Symantec), TR/Dldr.Crypter (Avira), Troj/Crypter-C (Sophos),

In the wild: No

Destructive: No

Language: English

Platform: Windows 98, NT, 2000, ME, XP

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

Medium

Distribution potential:

Low

Description: 

This memory-resident Trojan uses the Windows Cryptographic System to decode itself. It also accesses certain Web sites.

It drops a copy of itself in the Windows system folder using specific file names with EXE extension. It also drops an empty file in the Windows temporary folder using any of the file names, but without the extension.

This UPX-compressed malware runs on Windows 98, NT, ME, 2000, and XP.

For additional information about this threat, see:

Description created: May. 13, 2004 5:14:21 AM GMT -0800
Description updated: May. 22, 2004 4:29:47 AM GMT -0800


TECHNICAL DETAILS


Size of malware: 12,288 Bytes

Initial samples received on: May 13, 2004

Details:

Installation

This memory-resident Trojan uses the Windows Cryptographic System to decode itself. It drops a copy of itself in the Windows system folder using any of the following file names:

  • AUDIODRV.EXE
  • AUDIOINF.EXE
  • BLUECOL.EXE
  • CDDRV32.EXE
  • CMDCON.EXE
  • DISKINF.EXE
  • DLLREG.EXE
  • ENHANCE32.EXE
  • HELPEX32.EXE
  • INFDISK.EXE
  • KBDDRV32.EXE
  • KBDDRVINF.EXE
  • KBDRVINF.EXE
  • M32INFO.EXE
  • MAIN16.EXE
  • MAIN32.EXE
  • MOUSEBUT.EXE
  • MOUSEDRV.EXE,
  • MSURL32.EXE
  • MSWAVE.EXE
  • MSWAVEDLL.EXE
  • NETDLL32.EXE
  • NETDLLEX.EXE
  • P4MX4.EXE
  • PM32INFO.EXE
  • PWR32CRTL.EXE
  • PWR32CTR.EXE
  • SD32INFO.EXE
  • SVCINFO.EXE
  • SYSPWR.EXE
  • UN32INFO.EXE
  • VID32CNTL.EXE
  • VIDCNTL.EXE

It also drops an empty file in the Windows temporary folder using any of the abovementioned file names, but without the EXE extension.

Autostart Techniques

It creates the following registry entries to ensure its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
<malware name without file extension> = �%System%\malware name�

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
<malware name without file extension> = �%System%\malware name�

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\uninstall\<malware name>
DisplayName = "<malware name without file extension>"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\uninstall\<malware name>
UninstallString = "<%System%\malware name> <Uninstall Key>"

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)

Other Registry Modifications

On Windows 2000, NT, and XP, it creates the following registry entry:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
RUN = "%System%\<malware name>.exe"

On Windows 98, it adds the following line under [Windows] of WIN.INI:

RUN = %System%\<malware name>.exe




Analysis by: Karmina Aquino


SOLUTION


Minimum scan engine version needed: 6.500

Pattern file needed: 2.282.02

Pattern release date: May 13, 2004


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

AUTOMATIC REMOVAL INSTRUCTIONS

To automatically remove this malware from your system do the following steps:

  1. Click on Start>Settings>Control Panel
  2. Click on Add/Remove Programs
  3. Locate the malware name detected as TROJ_CRYPTER.A.
  4. Click on Remove
  5. Enter the uninstall key then press Enter

MANUAL REMOVAL INSTRUCTIONS

Identifying the Malware Program

To remove this malware, first identify the malware program.

  1. Scan your system with your Trend Micro antivirus product.
  2. NOTE all files detected as TROJ_CRYPTER.A.

Trend Micro customers need to download the latest pattern file before scanning their system. Other Internet users may use Housecall, Trend Micro�s free online virus scanner.

Terminating the Malware Program

This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.

  1. Open Windows Task Manager.
    On Windows 95/98/ME systems, press
    CTRL%20ALT%20DELETE
    On Windows NT/2000/XP systems, press
    CTRL%20SHIFT%20ESC, then click the Processes tab.
  2. In the list of running programs*, locate the malware file(s) detected earlier.
  3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
  4. Do the same for all detected malware files in the list of running processes.
  5. To check if the malware process has been terminated, close Task Manager, and then open it again.
  6. Close Task Manager.


*NOTE: On systems running Windows 95/98/ME, Windows Task Manager may not show certain processes. You may use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

  1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run
  3. In the right panel, locate and delete the entry:
    <malware name without file extension> = �%System%\malware name�
    Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.
  4. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows>CurrentVersion>Run
  5. In the right panel, locate and delete the entry:
    <malware name without file extension> = �%System%\malware name�
  6. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows>CurrentVersion>uninstall><malware name>
  7. In the right panel, locate and delete the entry:
    DisplayName = "<malware name without file extension>"
  8. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows>CurrentVersion>uninstall><malware name>
  9. In the right panel, locate and delete the entry:
    UninstallString = "<%System%\<malware name> <Uninstall Key>"
  10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows NT>CurrentVersion>Windows
  11. In the right panel, locate and delete the entry:
    RUN = "%System%\<malware name>.exe"
  12. Close Registry Editor.


NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.

Removing Autostart Entries from System Files

Malware sometimes modify system files so that they automatically execute at Windows startup. These autostart entries must be removed before an affected system can be restarted safely.

  1. Open the WIN.INI file using your default text editor. Click Start>Run. In the Open input box, type WIN.INI, then press Enter.
  2. Under the [windows] section, locate the lines that begin with:
    run =
  3. From the same lines, delete the malware path and file name:
    %System%\<malware name>.exe
  4. Close the WIN.INI file and click Yes when prompted to save.

Additional Windows ME/XP Cleaning Instructions

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as TROJ_CRYPTER.A . To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro�s free online virus scanner.


Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.