TROJ_MAGICON.A

Malware type: Trojan

Aliases: Downloader-DA.dll (McAfee), Adware.Slagent (Symantec), BDS/Magicon.J (Avira),

In the wild: No

Destructive: No

Language: English

Platform: Windows 95, 98, NT, 2000, ME, XP

Encrypted: Yes

Overall risk rating:

Reported infections:

Damage potential:

Medium

Distribution potential:

Low

Description: 

This memory-resident downloader Trojan is designed to terminate the following processes:

  • SYMPROXYSVC.EXE
  • SMC.EXE
  • PERSFW.EXE
  • AGENTW.EXE
  • ZONEALARM.EXE
  • BLACKICE.EXE

It has capabilities to download its latest version from the Internet and update itself.

It runs on Windows 95, 98, NT, ME, 2000 and XP.

For additional information about this threat, see:

Description created: Oct. 26, 2003 9:22:18 AM GMT -0800
Description updated: Dec. 24, 2003 11:49:57 PM GMT -0800


TECHNICAL DETAILS


Size of malware: 17, 408 Bytes (compressed);
45, 056 Bytes (uncompressed)

Initial samples received on: Oct 26, 2003

Payload 1: Terminates certain process

Trigger condition 1: Upon execution

Details:

Installation

Upon execution, this memory-resident Trojan program creates a folder named WINTRIM under the Windows directory. Then, it drops copies of itself in the WINTRIM or NAVPMC folders using the following file names:

  • WINTRIM.EXE
  • UNINSTALL.EXE
  • NAVPMC.EXE

It also drops the following non-malicious files in the same folder:

  • PersisDownloadPath
  • CompManagerPersist.mc2
  • acknowledged.mc2
  • OrderPersist.mc2

Also, when it finds that the infected system does not have Internet connection, this Trojan drops a .DLL file (0 Byte) in the WINTRIM or NAVPMC folders.

It further adds any of the following registry entries to uninstall it:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Uninstall\Wintrim
UninstallString "%Windows%\wintrim\uninstall.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Uninstall\simcss
UninstallString "%Windows%\simcss\uninstall.exe"

(Note: %Windows% is the Windows directory, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

To ensure that it executes at every system startup, this Trojan adds any of the following registry entries, depending on its version installed in the system:

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
MC = "%Windows%\wintrim\MAGICON.EXE"

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
cpntmgc = "%Windows%\SIMCSS\SIMCSS.EXE"

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
cpntmgc = "%Windows%\navpmc\NAVPMC.EXE"

Downloader Component

Next, it adds the following registry keys to set up the downloader program:

HKEY_CLASSES_ROOT\TypeLib\{BA49BD6A-039C-428E-
AF33-8C1288D75A7B}\1.0
@ "MagicControl 1.0 Type Library"

HKEY_CLASSES_ROOT\TypeLib\{BA49BD6A-039C-428E-
AF33-8C1288D75A7B}\1.0\FLAGS
@ "0"

HKEY_CLASSES_ROOT\TypeLib\{BA49BD6A-039C-428E-
AF33-8C1288D75A7B}\1.0\0\win32
@ "C:\Windows\WINTRIM\MAGICCONTROL.DLL"

HKEY_CLASSES_ROOT\TypeLib\{BA49BD6A-039C-
428E-AF33-8C1288D75A7B}\1.0\HELPDIR
@ "C:\Windows\WINTRIM\"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
MagicControl.MagicComponent.1
@ "MagicComponent Class"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
MagicControl.MagicComponent.1\CLSID
@ "{D7A82A12-05F5-42D8-B30D-6EF995075D2D}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
MagicControl.MagicComponent
@ "MagicComponent Class"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
MagicControl.MagicComponent\CLSID
@ "{D7A82A12-05F5-42D8-B30D-6EF995075D2D}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
MagicControl.MagicComponent\CurVer
@ "MagicControl.MagicComponent.1"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
CLSID\{D7A82A12-05F5-42D8-B30D-6EF995075D2D}
@ "MagicComponent Class"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
CLSID\{D7A82A12-05F5-42D8-B30D-6EF995075D2D}\ProgID
@ "MagicControl.MagicComponent.1"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
CLSID\{D7A82A12-05F5-42D8-B30D-6EF995075D2D}
\VersionIndependentProgID
@ "MagicControl.MagicComponent"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\
{D7A82A12-05F5-42D8-B30D-6EF995075D2D}\InprocServer32
@ "C:\Windows\WINTRIM\MAGICCONTROL.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\
{D7A82A12-05F5-42D8-B30D-6EF995075D2D}\TypeLib
@ "{BA49BD6A-039C-428E-AF33-8C1288D75A7B}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
Interface\{6D3F48F4-B40A-4C3F-A95C-85E23C3A8A91}
@ "IMagicComponent"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
Interface\{6D3F48F4-B40A-4C3F-A95C-
85E23C3A8A91}\ProxyStubClsid
@ "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
Interface\{6D3F48F4-B40A-4C3F-A95C
-85E23C3A8A91}\ProxyStubClsid32
@ "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
Interface\{6D3F48F4-B40A-4C3F-A95C-85E23C3A8A91}\TypeLib
@ "{BA49BD6A-039C-428E-AF33-8C1288D75A7B}"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
Interface\{6D3F48F4-B40A-4C3F-A95C-
85E23C3A8A91}\TypeLib
Version "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
TypeLib\{BA49BD6A-039C-428E-AF33-8C1288D75A7B}\1.0
@ "MagicControl 1.0 Type Library"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TypeLib\
{BA49BD6A-039C-428E-AF33-8C1288D75A7B}\1.0\0\win32
@ "C:\Windows\WINTRIM\MAGICCONTROL.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
TypeLib\{BA49BD6A-039C-428E-AF33-8C1288D75A7B}\1.0\HELPDIR
@ "C:\Windows\WINTRIM\"

Then, it attempts to download certain files, some of which are upgraded versions of itself while some are .DLL files it uses for its malicious routines, from the following Web site:

    http://dev-download.nocre<BLOCKED>tcard.com/download/Object/mc/

The downloaded .DLL files are capable of downloading files from the Internet and terminating certain system processes. Trend Micro detects the downloaded files as TROJ_MAGICON.A.

Payload

This Trojan looks for the following processes and terminates them, if they are running:

  • SYMPROXYSVC.EXE
  • SMC.EXE
  • PERSFW.EXE
  • AGENTW.EXE
  • ZONEALARM.EXE
  • BLACKICE.EXE

Other Details

While this Trojan downloads updated copies of itself to replace its older copy, it does not delete the files used by the previous version.

It is developed in Visual C%20%20 and compressed using UPX.




Analysis by: Marvin Cruz

Revision History:

First pattern file version: 1.709.58
First pattern file release date: Oct 26, 2003

SOLUTION


Minimum scan engine version needed: 7.000

Pattern file needed: 3.310.03

Pattern release date: Apr 4, 2006


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Uninstalling the Malware Program

This procedure removes the malware using its own uninstall program.

Please note that the uninstall program only works if the infected system has Internet connection. This procedure also fails to remove this malware's autostart registry keys and entries.

  1. Double-click the My Computer icon.
  2. Double-click the folder %Window% >SIMCSS, WINTRIM, or NAVPMC.
    Note: %Windows% is the Windows directory, which is usually C:\Windows or C:\WINNT.
  3. Double-click the UNINSTALL.EXE file.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

  1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows>CurrentVersion>Run
  3. In the right panel, locate and delete any of the following entries:
    MC = "%Windows%\wintrim\MAGICON.EXE"
    cpntmgc = "%Windows%\SIMCSS\SIMCSS.EXE"
    cpntmgc = "%Windows%\navpmc\NAVPMC.EXE"
    Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WinNT.
  4. Close Registry Editor.
NOTE: If you were not able to terminate the malware process from memory as described in the previous procedure, restart your system.

Terminating the Malware Program

This procedure terminates the running malware process from memory.

  1. Open Windows Task Manager.
    On Windows 95/98/ME systems, press
    CTRL%20ALT%20DELETE
    On Windows NT/2000/XP systems, press
    CTRL%20SHIFT%20ESC, and click the Processes tab.
  2. In the list of running programs*, locate the process:
    WINTRIM.EXE or SIMCSS.EXE or NAVPMC.EXE
  3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
  4. To check if the malware process has been terminated, close Task Manager, and then open it again.
  5. Close Task Manager.

Removing Malware Registry Keys

  1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
  2. In the left panel, locate and delete the following keys:
    • HKEY_CLASSES_ROOT\TypeLib\{BA49BD6A-039C
      -428E-AF33-8C1288D75A7B}
    • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
      MagicControl.MagicComponent.1
    • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
      MagicControl.MagicComponent
    • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
      CLSID\{D7A82A12-05F5-42D8-B30D-6EF995075D2D}
    • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
      Interface\{6D3F48F4-B40A-4C3F-A95C-85E23C3A8A91}
    • HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\
      TypeLib\{BA49BD6A-039C-428E-AF33-8C1288D75A7B}
  3. Close Registry Editor.

Additional Windows ME/XP Cleaning Instructions

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as TROJ_MAGICON.A. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro�s free online virus scanner.


Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.