TROJ_MALAGENT.JG

July 26, 2013

ALIASES:

Trojan:Win32/Malagent, Trojan:Win32/Malagent, Trojan:Win32/Msposer.A, Trojan:Win32/Msposer.A (Microsoft); [0002da4c.EXE\0002e290.EXE]:New Malware.dw !! (McAfee); Infostealer.Bancos (Symantec); Trojan-Spy.Win32.Vkont.ha (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); ERROR (FSecure); Found Luhe.Packed.A.dropper, Trojan horse Dropper.Generic2.CHHB, Trojan horse Dropper.Generic2.CHHB. (AVG)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size: 499,749 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 30 Apr 2013

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
GenericHostProcess

Other System Modifications

This Trojan deletes the following files:

%System%\dllcache\svchost.exe
%Windows%\1230.reg
%Windows%\1.bat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\
FLAGS

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\
0\win32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\
HELPDIR

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib

HKEY_CLASSES_ROOT\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}

HKEY_CLASSES_ROOT\NTService.Control.1

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
445:TCP = "445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
137:UDP = "137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
138:UDP = "138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
139:TCP = "139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%windir%\system32\dllcache\svchost.exe = "{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%windir%\system32\tlntsvr.exe = "%windir%\system32\tlntsvr.exe:*:Enabled:????"

HKEY_CURRENT_USER\Software\Microsoft\
DirectInput\MostRecentApplication
Version = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
DirectInput\MostRecentApplication
Name = "SVCHOST.EXE"

HKEY_CURRENT_USER\Software\Microsoft\
DirectInput\MostRecentApplication
Id = "SVCHOST.EXE4BF7C3D500048000"

HKEY_CURRENT_USER\Software\Microsoft\
DirectInput\MostRecentApplication
MostRecentStart = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
GenericHostProcess
EventMessageFile = "%System%\ntsvc.ocx"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
GenericHostProcess
TypesSupported = "7"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
NTService.Control.1
CLSID = "{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
ProgID = "NTService.Control.1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
InprocServer32 = "%System%\ntsvc.ocx"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
ToolboxBitmap32 = "%System%\ntsvc.ocx, 1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
MiscStatus = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
MiscStatus\1 = "199824"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
TypeLib = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
Version = "1.0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
UncheckedValue = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
UncheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Lsa
restrictanonymous = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Lsa
limitblankpassworduse = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
HRZR_EHAPCY = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Epoch
Epoch = "1ed"

(Note: The default value data of the said registry entry is 3d.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Print\Providers
LogonTime = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Lsa
forceguest = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CabinetState
FullPath = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32
ThreadingModel = "Apartment"

(Note: The default value data of the said registry entry is Apartment.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
Version = "1.0"

(Note: The default value data of the said registry entry is 1.0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
Version = "1.0"

(Note: The default value data of the said registry entry is 1.0.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine: 9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
- GenericHostProcess

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}
- Control

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {248DD890-BB45-11CF-9ABC-0080C7E7B78D}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
- {E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}
- 1.0

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0
- FLAGS

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0\0
- win32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}\1.0
- HELPDIR

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
- ProxyStubClsid

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
- ProxyStubClsid32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
- TypeLib

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface
- {E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}
- ProxyStubClsid

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}
- ProxyStubClsid32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}
- TypeLib

In HKEY_CLASSES_ROOT\CLSID
- {E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}

In HKEY_CLASSES_ROOT
- NTService.Control.1

To delete the registry key this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>EventLog>Application
Still in the left panel, locate and delete the key:
GenericHostProcess
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{248DD896-BB45-11CF-9ABC-0080C7E7B78D}
Still in the left panel, locate and delete the key:
Control
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
Still in the left panel, locate and delete the key:
{248DD890-BB45-11CF-9ABC-0080C7E7B78D}
Again Still in the left panel, locate and delete the key:
{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}
Still in the left panel, locate and delete the key:
1.0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}>1.0
Still in the left panel, locate and delete the key:
FLAGS
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}>1.0>0
Still in the left panel, locate and delete the key:
win32
Again Still in the left panel, locate and delete the key:
HELPDIR
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
Still in the left panel, locate and delete the key:
{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}
Still in the left panel, locate and delete the key:
ProxyStubClsid
Again Still in the left panel, locate and delete the key:
ProxyStubClsid32
Again Still in the left panel, locate and delete the key:
TypeLib
Again Still in the left panel, locate and delete the key:
{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}
Still in the left panel, locate and delete the key:
ProxyStubClsid
Again Still in the left panel, locate and delete the key:
ProxyStubClsid32
Again Still in the left panel, locate and delete the key:
TypeLib
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID
Still in the left panel, locate and delete the key:
{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
In the left panel, double-click the following:
HKEY_CLASSES_ROOT
Still in the left panel, locate and delete the key:
NTService.Control.1
Close Registry Editor.

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
- 445:TCP = "445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
- 137:UDP = "137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
- 138:UDP = "138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
- 139:TCP = "139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %windir%\system32\dllcache\svchost.exe = "{random characters}"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %windir%\system32\tlntsvr.exe = "%windir%\system32\tlntsvr.exe:*:Enabled:????"

In HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication
- Version = "{random values}"

In HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication
- Name = "SVCHOST.EXE"

In HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication
- Id = "SVCHOST.EXE4BF7C3D500048000"

In HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication
- MostRecentStart = "{random values}"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\GenericHostProcess
- EventMessageFile = "%System%\ntsvc.ocx"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\GenericHostProcess
- TypesSupported = "7"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib
- Version = "1.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib
- Version = "1.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NTService.Control.1
- CLSID = "{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- ProgID = "NTService.Control.1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- InprocServer32 = "%System%\ntsvc.ocx"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- ToolboxBitmap32 = "%System%\ntsvc.ocx, 1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- MiscStatus = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- MiscStatus\1 = "199824"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- TypeLib = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
- Version = "1.0"

To delete the registry value this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>GloballyOpenPorts>List
In the right panel, locate and delete the entry:
445:TCP = "445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
Again In the right panel, locate and delete the entry:
137:UDP = "137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
Again In the right panel, locate and delete the entry:
138:UDP = "138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"
Again In the right panel, locate and delete the entry:
139:TCP = "139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
In the right panel, locate and delete the entry:
%windir%\system32\dllcache\svchost.exe = "{random characters}"
Again In the right panel, locate and delete the entry:
%windir%\system32\tlntsvr.exe = "%windir%\system32\tlntsvr.exe:*:Enabled:????"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>DirectInput>MostRecentApplication
In the right panel, locate and delete the entry:
Version = "{random values}"
Again In the right panel, locate and delete the entry:
Name = "SVCHOST.EXE"
Again In the right panel, locate and delete the entry:
Id = "SVCHOST.EXE4BF7C3D500048000"
Again In the right panel, locate and delete the entry:
MostRecentStart = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application>GenericHostProcess
In the right panel, locate and delete the entry:
EventMessageFile = "%System%\ntsvc.ocx"
Again In the right panel, locate and delete the entry:
TypesSupported = "7"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}>TypeLib
In the right panel, locate and delete the entry:
Version = "1.0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}>TypeLib
In the right panel, locate and delete the entry:
Version = "1.0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NTService.Control.1
In the right panel, locate and delete the entry:
CLSID = "{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}
In the right panel, locate and delete the entry:
ProgID = "NTService.Control.1"
Again In the right panel, locate and delete the entry:
InprocServer32 = "%System%\ntsvc.ocx"
Again In the right panel, locate and delete the entry:
ToolboxBitmap32 = "%System%\ntsvc.ocx, 1"
Again In the right panel, locate and delete the entry:
MiscStatus = "0"
Again In the right panel, locate and delete the entry:
MiscStatus\1 = "199824"
Again In the right panel, locate and delete the entry:
TypeLib = "{E7BC34A0-BA86-11CF-84B1-CBC2DA68BF6C}"
Again In the right panel, locate and delete the entry:
Version = "1.0"
Close Registry Editor.

Step 5

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
- UncheckedValue = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
- From: CheckedValue = "0"
  To: CheckedValue = ""1""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
- From: UncheckedValue = "0"
  To: UncheckedValue = ""1""

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = "2"
  To: Hidden = ""2""

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideFileExt = "1"
  To: HideFileExt = ""1""

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- SuperHidden = "1"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
- restrictanonymous = "0"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
- From: limitblankpassworduse = "0"
  To: limitblankpassworduse = ""1""

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
- From: HRZR_EHAPCY = "{random values}"
  To: HRZR_EHAPCY = ""{random values}""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Epoch
- From: Epoch = "1ed"
  To: Epoch = ""3d""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers
- From: LogonTime = "{random values}"
  To: LogonTime = ""{random values}""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
- From: forceguest = "0"
  To: forceguest = ""1""

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
- FullPath = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32
- From: ThreadingModel = "Apartment"
  To: ThreadingModel = ""Apartment""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
- From: Version = "1.0"
  To: Version = ""1.0""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib
- From: Version = "1.0"
  To: Version = ""1.0""

To restore registry values this malware/grayware modified:

Open Registry Editor. To do this:
- On Windows 2000, XP, and Server 2003:
  Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
- On Windows Vista and 7:
  Click the Start button, type REGEDIT in the Search input field then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>HideFileExt
In the right panel, locate the registry value:
UncheckedValue = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
In the right panel, locate the registry value:
CheckedValue = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
CheckedValue = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>SuperHidden
In the right panel, locate the registry value:
UncheckedValue = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
UncheckedValue = "1"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the registry value:
Hidden = "2"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Hidden = "2"
Again In the right panel, locate the registry value:
HideFileExt = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HideFileExt = "1"
Again In the right panel, locate the registry value:
SuperHidden = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>Lsa
In the right panel, locate the registry value:
restrictanonymous = "0"
Again In the right panel, locate the registry value:
limitblankpassworduse = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
limitblankpassworduse = "1"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>UserAssist>{75048700-EF1F-11D0-9888-006097DEACF9}>Count
In the right panel, locate the registry value:
HRZR_EHAPCY = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HRZR_EHAPCY = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Epoch
In the right panel, locate the registry value:
Epoch = "1ed"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Epoch = "3d"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>Print>Providers
In the right panel, locate the registry value:
LogonTime = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
LogonTime = "{random values}"
Again In the right panel, locate the registry value:
forceguest = "0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
forceguest = "1"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>CabinetState
In the right panel, locate the registry value:
FullPath = "1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{248DD896-BB45-11CF-9ABC-0080C7E7B78D}>InprocServer32
In the right panel, locate the registry value:
ThreadingModel = "Apartment"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ThreadingModel = "Apartment"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{248DD892-BB45-11CF-9ABC-0080C7E7B78D}>TypeLib
In the right panel, locate the registry value:
Version = "1.0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Version = "1.0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{248DD893-BB45-11CF-9ABC-0080C7E7B78D}>TypeLib
In the right panel, locate the registry value:
Version = "1.0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Version = "1.0"
Close Registry Editor.

Step 6

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_MALAGENT.JG. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 7

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%System%\dllcache\svchost.exe
%Windows%\1230.reg
%Windows%\1.bat

Step 8

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {248DD896-BB45-11CF-9ABC-0080C7E7B78D}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {248DD897-BB45-11CF-9ABC-0080C7E7B78D}

Did this description help? Tell us how we did.

TROJ_MALAGENT.JG

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

TROJ_MALAGENT.JG

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific