PE_QUERVAR.G-O
Windows 2000, Windows XP, Windows Server 2003

Threat Type: File infector
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It infects certain file types by inserting code in the said files.
TECHNICAL DETAILS
Arrival Details
This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This file infector drops the following copies of itself into the affected system:
- %User Temp%\{random folder name}\{random file name}.exe
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
It creates the following folders:
- %User Temp%\{random folder name}
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)
It terminates itself if it finds the following processes in the affected system's memory:
- taskmgr.exe
Autostart Technique
This file infector drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:
- %User Startup%\{random file name}.lnk
(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)
File Infection
This file infector infects files with the following file extensions by inserting code in the said files:
- *.exe
- *.doc
- *.xls
- *.docx
- *.xlsx
Download Routine
This file infector connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}p.com/admin/view/theme/default/tpl/layout.php
- http://www.{BLOCKED}group.com/administrator/includes/way.php
- http://{BLOCKED}city.com/wp-includes/js/tinymce/wp-tinymm.php
- https://{BLOCKED}s.{BLOCKED}ion.com/image.php?u=3089
NOTES:
It is capable of infecting all logical drives except CD-ROms present on the system as long as the following folder is not present on the drive:
- System Volume Information
It is capable of renaming infected files (*.doc, *.xls, *.docx, *.xlsx) adding the Unicode for Right to Left Override (RLO) character to disguise that the renamed file is still a document/spreadsheet file but are actually executables:
- .doc - {RLO}cod.scr - will appear as rsc.doc
- .xls - {RLO}slx.scr - will appear as rsc.xls
- .docx - {RLO}xcod.scr - will appear as rsc.docx
- .xlsx - {RLO}xslx.scr - will appear as rsc.xlsx
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Scan your computer with your Trend Micro product and note files detected as PE_QUERVAR.G-O
Step 3
Terminate a process file/s detected as PE_QUERVAR.G-O
*Note: If the detected file/s is/are not displayed in theWindows Task Manager, continue doing the next steps.
Step 4
Search and delete these files
- %User Startup%\{random file name}.lnk
Step 5
Remove the malware/grayware file dropped/downloaded by PE_QUERVAR.G-O
- PE_QUERVAR.G
Step 6
Scan your computer with your Trend Micro product to delete files detected as PE_QUERVAR.G-O. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.