PE_NESHTA.A

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It prepends its codes to target files.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus drops the following files:

• %Windows%\svchost.com → detected as PE_NESHTA.A-O
• %User Temp%\3582-490\{Malware Filename} → clean version of infected file
• %User Temp%\tmp5023.tmp

It adds the following processes:

• %User Temp%\3582-490\{Malware Filename}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\3582-490\

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MutexPolesskayaGlush*.*{\xc2\x90}svchost.com\xc2\x90exefile\shell\open\command\xe2\x80\xb9\xc3\x80 "%1" %*\xc5\x93\xe2\x80\x98@

Other System Modifications

This Virus modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile\shell\open\
command
(Default) = "%Windows%\svchost.com "%1" %*"

File Infection

This Virus infects the following file types:

• EXE

It prepends its codes to target files.

It avoids infecting folders containing the following strings:

• PROGRA~1
• %Windows%
• %Temp%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It avoids infecting files of the following sizes:

• less than 41,472 bytes or greater than 10,000,000 bytes

This is the Trend Micro detection for files infected by:

• PE_NESHTA.A-O

Other Details

This Virus does the following:

• It avoids infecting files from the following drives:
  • CD-ROM
  • A:\
  • B:\