TSPY_DERUSBI.D

This spyware may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is a component of other malware.

It requires its main component to successfully perform its intended routine.

Arrival Details

This spyware may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %System%\msusb{random 3 letters}.dat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %Windows%\Temp\ziptmp$1.tmp21

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It is a component of other malware.

Autostart Technique

This spyware modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv\Parameters
ServiceDll = %Systemroot%\System32\msusb{random 3 letters}.dat

(Note: The default value data of the said registry entry is %System%\wuauserv.dll.)

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv\Parameters
Security = {random values}

Other Details

This spyware requires its main component to successfully perform its intended routine.