TROJ_INJEK.XPL

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware/spyware from remote sites.

It deletes registry entries, causing some applications and programs to not function properly.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan drops the following file(s)/component(s):

• del{random}.bat- deletes the malware and itself
• %System%\drivers\firemodifyds.sys - executed as service

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This Trojan registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds
Start = "3"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds
ImagePath = \??\%System%\drivers\firemodifyds.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds
DisplayName = firemodifyds

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds\Security
Security = "{hex values}"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\firemodifyds

It deletes the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
AhnLab V3Lite Tray Process = "{system value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
HEProtect = "{system value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
V3 Application = "{system value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSC = "{system value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
ALYac = "{system value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Vrmon = "{system value}"

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.31.154/mii/firw.gif

It saves the files it downloads using the following names:

• %User Temp%\decdossvview.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Trend Micro detects the dowloaded file as:

• Mal_OLGM-6

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

This Trojan attempts to uninstall from following related security products:

• AHNLAB
• ESTsoft-ALYac
• NHN CORPORATION-Naver Vaccine

It deletes the following security related files and terminates related processes:

• %Program Files%\Microsoft Security Client\msseces.exe
• %Program Files%\Microsoft Security Client\Antimalware\MpCmdRun.exe
• %Program Files%\Microsoft Security Client\Antimalware\MsMpEng.exe

It stops the following services:

• MsMpSvc
• NVCSvcMgr

It may terminate the following process when found an installed security related products:

• NVCAgent.npc
• Nsavsvc.npc
• Nsvmon.npc
• NVCAgent.exe
• Nsavsvc.exe
• Nsvmon.exe
• NVCUpgrader.exe
• NaverAgent.exe
• V3LTray.exe
• V3LSvc.exe
• V3Light.exe
• V3LRun.exe
• MUpdate2.exe