Trojan.AVKill.7230

Trojan.AVKill.7230

Added to the Dr.Web virus database: 2011-06-28

Virus description added: 2011-07-01

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_Dlls' = '<SYSTEM32>\scriptpw32.dll'

Creates the following services:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\msidntld32.exe' = '<SYSTEM32>\msidntld32.exe:*:Enabled:Windows Update Service'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\msidntld32.exe' = '<SYSTEM32>\msidntld32.exe:*:Enabled:Windows Update Service'

Creates and executes the following:

Executes the following:

<SYSTEM32>\netsh.exe firewall add allowedprogram program="<SYSTEM32>\msidntld32.exe" name="Windows Update Service" mode=ENABLE scope=ALL profile=ALL

Terminates or attempts to terminate

the following user processes:

Modifies file system :

Creates the following files:

<SYSTEM32>\02000000b4da02141278P.manifest
<SYSTEM32>\02000000b4da02141278C.manifest
%APPDATA%\SysWin\lsass.exe
<SYSTEM32>\scriptpw32.dll
<SYSTEM32>\02000000b4da02141278S.manifest
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
<SYSTEM32>\02000000b4da02141278O.manifest
<SYSTEM32>\kbdmac32.exe
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{4e49adcd-952d-4f13-9fdf-1f3d75312455}\defaults\preferences\xulcache.js
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{4e49adcd-952d-4f13-9fdf-1f3d75312455}\chrome\xulcache.jar
<SYSTEM32>\avmeter32.dll
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{4e49adcd-952d-4f13-9fdf-1f3d75312455}\install.rdf
<SYSTEM32>\1444526677
<SYSTEM32>\msidntld32.exe
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{4e49adcd-952d-4f13-9fdf-1f3d75312455}\chrome.manifest
<SYSTEM32>\scriptpw32.exe

Network activity:

Connects to:

TCP:

HTTP GET requests:

wpad.localdomain/wpad.dat
89.##7.53.210/barak/mJKV_1PddccPeTTfWEbTTPURWQOQOedTeWWaQU-6XBB_1WWQQ-6GF5_1NW-tWEIO-6LC6_1Y-gW-gEUQQ-gE-tsDF6K5D_rpX51_rE-t-66FC_1Q_fQ_fQ_fQ_fQ_fQ_fQ_fQ_fE-62BG_1Q-672V_1WEIO-6D85_1W-6N8J_1Q-6252_1WQYO-69LV_1-65GZ_1W-6N54_1RTO-6

UDP: