Search Newbit Technology

Sunday, April 19, 2009

Latest Virus April 18, 2009

Discovered: April 18, 2009
Updated: April 19, 2009 10:49:10 AM
Type: Virus
Infection Length: 69,632 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

When the threat is executed, it creates the following file:
%System%\drivers\[RANDOM NAME].sys (W32.HLLP.Sality)

The .sys file is then executed as a service with the following name and then deleted:
abp470n5

The service acts as filter on the IPFILTERDRIVER service. It monitors for and drops network packets containing any of the following strings:
  • upload_virus
  • sality-remov
  • virusinfo.
  • cureit.
  • drweb.
  • onlinescan.
  • spywareinfo.
  • ewido.
  • virusscan.
  • windowsecurity.
  • spywareguide.
  • bitdefender.
  • pandasoftware.
  • agnmitum.
  • virustotal.
  • sophos.
  • trendmicro.
  • etrust.com
  • symantec.
  • mcafee.
  • f-secure.
  • eset.com
  • kaspersky
  • aPv

It then creates the following registry entries:
  • HKEY_CURRENT_USER\Software\[RANDOM CHARACTERS]\"V[NUMBER]_[THREE RANDOM NUMBER]" = [RANDOM VALUE]
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"GlobalUserOffline" = "0"
  • HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\policies\system\"EnableLUA" = "0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"ConsoleTracingMask" = "4294901760"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"EnableConsoleTracing" = "0"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"EnableFileTracing" = "0"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"FileDirectory" = "%Windir%\tracing"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"FileTracingMask" = "4294901760"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"MaxFileSize" = "1048576"


It also sets the following registry entries to change security settings:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\"FirewallDisableNotify" = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\"FirewallOverride" = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"UacDisableNotify" = "1"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\"UacDisableNotify" = "1"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\"DoNotAllowExceptions" = "0"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%SystemDrive%\[ORIGINAL THREAT FILE NAME].exe" = "%SystemDrive%\[ORIGINAL THREAT FILE NAME].exe:*:Enabled:ipsec"
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\Explorer.EXE" = "%Windir%\Explorer.EXE:*:Enabled:ipsec"


It deletes all registry entries under the following subkeys:
  • HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot
  • HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
  • HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects


Next, it attempts to stop services with names that contains any of the following strings:
  • Agnitum Client Security Service
  • ALG
  • Amon monitor
  • aswUpdSv
  • aswMon2
  • aswRdr
  • aswSP
  • aswTdi
  • aswFsBlk
  • acssrv
  • AV Engine
  • avast! iAVS4 Control Service
  • avast! Antivirus
  • avast! Mail Scanner
  • avast! Web Scanner
  • avast! Asynchronous Virus Monitor
  • avast! Self Protection
  • AVG E-mail Scanner
  • Avira AntiVir Premium Guard
  • Avira AntiVir Premium WebGuard
  • Avira AntiVir Premium MailGuard
  • avp1
  • BackWeb Plug-in - 4476822
  • bdss
  • BGLiveSvc
  • BlackICE
  • CAISafe
  • ccEvtMgr
  • ccProxy
  • ccSetMgr
  • COMODO Firewall Pro Sandbox Driver
  • cmdGuard
  • cmdAgent
  • Eset Service
  • Eset HTTP Server
  • Eset Personal Firewall
  • F-Prot Antivirus Update Monitor
  • fsbwsys
  • FSDFWD
  • F-Secure Gatekeeper Handler Starter
  • FSMA
  • Google Online Services
  • InoRPC
  • InoRT
  • InoTask
  • ISSVC
  • KPF4
  • KLIF
  • LavasoftFirewall
  • LIVESRV
  • McAfeeFramework
  • McShield
  • McTaskManager
  • navapsvc
  • NOD32krn
  • NPFMntor
  • NSCService
  • Outpost Firewall main module
  • OutpostFirewall
  • PAVFIRES
  • PAVFNSVR
  • PavProt
  • PavPrSrv
  • PAVSRV
  • PcCtlCom
  • PersonalFirewal
  • PREVSRV
  • ProtoPort Firewall service
  • PSIMSVC
  • RapApp
  • SmcService
  • SNDSrvc
  • SPBBCSvc
  • SpIDer FS Monitor for Windows NT
  • SpIDer Guard File System Monitor
  • SPIDERNT
  • Symantec Core LC
  • Symantec Password Validation
  • Symantec AntiVirus Definition Watcher
  • SavRoam
  • Symantec AntiVirus
  • Tmntsrv
  • TmPfw
  • tmproxy
  • tcpsr
  • UmxAgent
  • UmxCfg
  • UmxLU
  • UmxPol
  • vsmon
  • VSSERV
  • WebrootDesktopFirewallDataService
  • WebrootFirewall
  • XCOMM
  • AVP


It also attempts to end processes with names that contain any of the following strings:
  • _AVPM.
  • A2GUARD.
  • AAVSHIELD.
  • AVAST
  • ADVCHK.
  • AHNSD.
  • AIRDEFENSE
  • ALERTSVC
  • ALOGSERV
  • ALSVC.
  • AMON.
  • ANTI-TROJAN.
  • AVZ.
  • ANTIVIR
  • APVXDWIN.
  • ARMOR2NET.
  • ASHAVAST.
  • ASHDISP.
  • ASHENHCD.
  • ASHMAISV.
  • ASHPOPWZ.
  • ASHSERV.
  • ASHSIMPL.
  • ASHSKPCK.
  • ASHWEBSV.
  • ASWUPDSV.
  • ATCON.
  • ATUPDATER.
  • ATWATCH.
  • AVCIMAN.
  • AVCONSOL.
  • AVENGINE.
  • AVESVC.
  • AVGAMSVR.
  • AVGCC.
  • AVGCC32.
  • AVGCTRL.
  • AVGEMC.
  • AVGFWSRV.
  • AVGNT.
  • AVGNTDD
  • AVGNTMGR
  • AVGSERV.
  • AVGUARD.
  • AVGUPSVC.
  • AVINITNT.
  • AVKSERV.
  • AVKSERVICE.
  • AVKWCTL.
  • AVP.
  • AVP32.
  • AVPCC.
  • AVPM.
  • AVAST
  • AVSERVER.
  • AVSCHED32.
  • AVSYNMGR.
  • AVWUPD32.
  • AVWUPSRV.
  • AVXMONITOR9X.
  • AVXMONITORNT.
  • AVXQUAR.
  • BDMCON.
  • BDNEWS.
  • BDSUBMIT.
  • BDSWITCH.
  • BLACKD.
  • BLACKICE.
  • CAFIX.
  • CCAPP.
  • CCEVTMGR.
  • CCPROXY.
  • CCSETMGR.
  • CFIAUDIT.
  • CLAMTRAY.
  • CLAMWIN.
  • CLAW95.
  • CUREIT
  • DEFWATCH.
  • DRVIRUS.
  • DRWADINS.
  • DRWEB32W.
  • DRWEBSCD.
  • DRWEBUPW.
  • DWEBLLIO
  • DWEBIO
  • ESCANH95.
  • ESCANHNT.
  • EWIDOCTRL.
  • EZANTIVIRUSREGISTRATIONCHECK.
  • F-AGNT95.
  • FAMEH32.
  • FILEMON
  • FIRESVC.
  • FIRETRAY.
  • FIREWALL.
  • FPAVUPDM.
  • F-PROT95.
  • FRESHCLAM.
  • EKRN.
  • FSAV32.
  • FSAVGUI.
  • FSBWSYS.
  • F-SCHED.
  • FSDFWD.
  • FSGK32.
  • FSGK32ST.
  • FSGUIEXE.
  • FSMA32.
  • FSMB32.
  • FSPEX.
  • FSSM32.
  • F-STOPW.
  • GCASDTSERV.
  • GCASSERV.
  • GIANTANTISPYWAREMAIN.
  • GIANTANTISPYWAREUPDATER.
  • GUARDGUI.
  • GUARDNT.
  • HREGMON.
  • HRRES.
  • HSOCKPE.
  • HUPDATE.
  • IAMAPP.
  • IAMSERV.
  • ICLOAD95.
  • ICLOADNT.
  • ICMON.
  • ICSSUPPNT.
  • ICSUPP95.
  • ICSUPPNT.
  • IFACE.
  • INETUPD.
  • INOCIT.
  • INORPC.
  • INORT.
  • INOTASK.
  • INOUPTNG.
  • IOMON98.
  • ISAFE.
  • ISATRAY.
  • ISRV95.
  • ISSVC.
  • KAV.
  • KAVMM.
  • KAVPF.
  • KAVPFW.
  • KAVSTART.
  • KAVSVC.
  • KAVSVCUI.
  • KMAILMON.
  • KPFWSVC.
  • MCAGENT.
  • MCMNHDLR.
  • MCREGWIZ.
  • MCUPDATE.
  • MCVSSHLD.
  • MINILOG.
  • MYAGTSVC.
  • MYAGTTRY.
  • NAVAPSVC.
  • NAVAPW32.
  • NAVLU32.
  • NAVW32.
  • NEOWATCHLOG.
  • NEOWATCHTRAY.
  • NISSERV
  • NISUM.
  • NMAIN.
  • NOD32
  • NORMIST.
  • NOTSTART.
  • NPAVTRAY.
  • NPFMNTOR.
  • NPFMSG.
  • NPROTECT.
  • NSCHED32.
  • NSMDTR.
  • NSSSERV.
  • NSSTRAY.
  • NTRTSCAN.
  • NTOS.
  • NTXCONFIG.
  • NUPGRADE.
  • NVCOD.
  • NVCTE.
  • NVCUT.
  • NWSERVICE.
  • OFCPFWSVC.
  • OUTPOST
  • OP_MON.
  • PAVFIRES.
  • PAVFNSVR.
  • PAVKRE.
  • PAVPROT.
  • PAVPROXY.
  • PAVPRSRV.
  • PAVSRV51.
  • PAVSS.
  • PCCGUIDE.
  • PCCIOMON.
  • PCCNTMON.
  • PCCPFW.
  • PCCTLCOM.
  • PCTAV.
  • PERSFW.
  • PERTSK.
  • PERVAC.
  • PNMSRV.
  • POP3TRAP.
  • POPROXY.
  • PREVSRV.
  • PSIMSVC.
  • QHM32.
  • QHONLINE.
  • QHONSVC.
  • QHPF.
  • QHWSCSVC.
  • RAVMON.
  • RAVTIMER.
  • AVGNT
  • AVCENTER.
  • RFWMAIN.
  • RTVSCAN.
  • RTVSCN95.
  • RULAUNCH.
  • SALITY
  • SAVADMINSERVICE.
  • SAVMAIN.
  • SAVPROGRESS.
  • SAVSCAN.
  • SCANNINGPROCESS.
  • CUREIT
  • SDHELP.
  • SHSTAT.
  • SITECLI.
  • SPBBCSVC.
  • SPHINX.
  • SPIDERCPL.
  • SPIDERML.
  • SPIDERNT.
  • SPIDERUI.
  • SPYBOTSD.
  • SPYXX.
  • SS3EDIT.
  • STOPSIGNAV.
  • SWAGENT.
  • SWDOCTOR.
  • SWNETSUP.
  • SYMLCSVC.
  • SYMPROXYSVC.
  • SYMSPORT.
  • SYMWSC.
  • SYNMGR.
  • TAUMON.
  • TBMON.
  • AVAST
  • TFAK.
  • THAV.
  • THSM.
  • TMAS.
  • TMLISTEN.
  • TMNTSRV.
  • TMPFW.
  • TMPROXY.
  • TNBUTIL.
  • TRJSCAN.
  • UP2DATE.
  • VBA32ECM.
  • VBA32IFS.
  • VBA32LDR.
  • VBA32PP3.
  • VBSNTW.
  • VCHK.
  • VCRMON.
  • VETTRAY.
  • VIRUSKEEPER.
  • VPTRAY.
  • VRFWSVC.
  • VRMONNT.
  • VRMONSVC.
  • VRRW32.
  • VSECOMR.
  • VSHWIN32.
  • VSMON.
  • VSSERV.
  • VSSTAT.
  • WATCHDOG.
  • WEBPROXY.
  • WEBSCANX.
  • WEBTRAP.
  • WGFE95.
  • WINAW32.
  • WINROUTE.
  • WINSS.
  • WINSSNOTIFY.
  • WRCTRL.
  • XCOMMSVR.
  • ZAUINST
  • ZLCLIENT
  • ZONEALARM


The threat will also end processes which load any of the following modules into memory:
  • DWEBLLIO
  • DWEBIO


It deletes files with names that contains any of the following strings:
  • .VDB
  • .AVC
  • .KEY


Next, it checks the following registry subkeys and infects any files listed within them:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run


The threat then enumerates network resources using the WNetOpenEnumA API. If any resources are found, it will search it for executable files to infect.

It then checks for removable drives and attempts to copy an infected copies of notepad.exe or winmime.exe as one of the following files:
  • [RANDOM NAME].exe
  • [RANDOM NAME].cmd
  • [RANDOM NAME].pif


An autorun.inf file is created in order to execute the threat when the removable drive is inserted into another computer.

The threat avoids infecting files with any of the following strings in the file name:
  • _AVPM.
  • A2GUARD.
  • AAVSHIELD.
  • AVAST
  • ADVCHK.
  • AHNSD.
  • AIRDEFENSE
  • ALERTSVC
  • ALOGSERV
  • ALSVC.
  • AMON.
  • ANTI-TROJAN.
  • AVZ.
  • ANTIVIR
  • APVXDWIN.
  • ARMOR2NET.
  • ASHAVAST.
  • ASHDISP.
  • ASHENHCD.
  • ASHMAISV.
  • ASHPOPWZ.
  • ASHSERV.
  • ASHSIMPL.
  • ASHSKPCK.
  • ASHWEBSV.
  • ASWUPDSV.
  • ATCON.
  • ATUPDATER.
  • ATWATCH.
  • AVCIMAN.
  • AVCONSOL.
  • AVENGINE.
  • AVESVC.
  • AVGAMSVR.
  • AVGCC.
  • AVGCC32.
  • AVGCTRL.
  • AVGEMC.
  • AVGFWSRV.
  • AVGNT.
  • AVGNTDD
  • AVGNTMGR
  • AVGSERV.
  • AVGUARD.
  • AVGUPSVC.
  • AVINITNT.
  • AVKSERV.
  • AVKSERVICE.
  • AVKWCTL.
  • AVP.
  • AVP32.
  • AVPCC.
  • AVPM.
  • AVAST
  • AVSERVER.
  • AVSCHED32.
  • AVSYNMGR.
  • AVWUPD32.
  • AVWUPSRV.
  • AVXMONITOR9X.
  • AVXMONITORNT.
  • AVXQUAR.
  • BDMCON.
  • BDNEWS.
  • BDSUBMIT.
  • BDSWITCH.
  • BLACKD.
  • BLACKICE.
  • CAFIX.
  • CCAPP.
  • CCEVTMGR.
  • CCPROXY.
  • CCSETMGR.
  • CFIAUDIT.
  • CLAMTRAY.
  • CLAMWIN.
  • CLAW95.
  • CUREIT
  • DEFWATCH.
  • DRVIRUS.
  • DRWADINS.
  • DRWEB32W.
  • DRWEBSCD.
  • DRWEBUPW.
  • DWEBLLIO
  • DWEBIO
  • ESCANH95.
  • ESCANHNT.
  • EWIDOCTRL.
  • EZANTIVIRUSREGISTRATIONCHECK.
  • F-AGNT95.
  • FAMEH32.
  • FILEMON
  • FIRESVC.
  • FIRETRAY.
  • FIREWALL.
  • FPAVUPDM.
  • F-PROT95.
  • FRESHCLAM.
  • EKRN.
  • FSAV32.
  • FSAVGUI.
  • FSBWSYS.
  • F-SCHED.
  • FSDFWD.
  • FSGK32.
  • FSGK32ST.
  • FSGUIEXE.
  • FSMA32.
  • FSMB32.
  • FSPEX.
  • FSSM32.
  • F-STOPW.
  • GCASDTSERV.
  • GCASSERV.
  • GIANTANTISPYWAREMAIN.
  • GIANTANTISPYWAREUPDATER.
  • GUARDGUI.
  • GUARDNT.
  • HREGMON.
  • HRRES.
  • HSOCKPE.
  • HUPDATE.
  • IAMAPP.
  • IAMSERV.
  • ICLOAD95.
  • ICLOADNT.
  • ICMON.
  • ICSSUPPNT.
  • ICSUPP95.
  • ICSUPPNT.
  • IFACE.
  • INETUPD.
  • INOCIT.
  • INORPC.
  • INORT.
  • INOTASK.
  • INOUPTNG.
  • IOMON98.
  • ISAFE.
  • ISATRAY.
  • ISRV95.
  • ISSVC.
  • KAV.
  • KAVMM.
  • KAVPF.
  • KAVPFW.
  • KAVSTART.
  • KAVSVC.
  • KAVSVCUI.
  • KMAILMON.
  • KPFWSVC.
  • MCAGENT.
  • MCMNHDLR.
  • MCREGWIZ.
  • MCUPDATE.
  • MCVSSHLD.
  • MINILOG.
  • MYAGTSVC.
  • MYAGTTRY.
  • NAVAPSVC.
  • NAVAPW32.
  • NAVLU32.
  • NAVW32.
  • NEOWATCHLOG.
  • NEOWATCHTRAY.
  • NISSERV
  • NISUM.
  • NMAIN.
  • NOD32
  • NORMIST.
  • NOTSTART.
  • NPAVTRAY.
  • NPFMNTOR.
  • NPFMSG.
  • NPROTECT.
  • NSCHED32.
  • NSMDTR.
  • NSSSERV.
  • NSSTRAY.
  • NTRTSCAN.
  • NTOS.
  • NTXCONFIG.
  • NUPGRADE.
  • NVCOD.
  • NVCTE.
  • NVCUT.
  • NWSERVICE.
  • OFCPFWSVC.
  • OUTPOST
  • OP_MON.
  • PAVFIRES.
  • PAVFNSVR.
  • PAVKRE.
  • PAVPROT.
  • PAVPROXY.
  • PAVPRSRV.
  • PAVSRV51.
  • PAVSS.
  • PCCGUIDE.
  • PCCIOMON.
  • PCCNTMON.
  • PCCPFW.
  • PCCTLCOM.
  • PCTAV.
  • PERSFW.
  • PERTSK.
  • PERVAC.
  • PNMSRV.
  • POP3TRAP.
  • POPROXY.
  • PREVSRV.
  • PSIMSVC.
  • QHM32.
  • QHONLINE.
  • QHONSVC.
  • QHPF.
  • QHWSCSVC.
  • RAVMON.
  • RAVTIMER.
  • AVGNT
  • AVCENTER.
  • RFWMAIN.
  • RTVSCAN.
  • RTVSCN95.
  • RULAUNCH.
  • SALITY
  • SAVADMINSERVICE.
  • SAVMAIN.
  • SAVPROGRESS.
  • SAVSCAN.
  • SCANNINGPROCESS.
  • CUREIT
  • SDHELP.
  • SHSTAT.
  • SITECLI.
  • SPBBCSVC.
  • SPHINX.
  • SPIDERCPL.
  • SPIDERML.
  • SPIDERNT.
  • SPIDERUI.
  • SPYBOTSD.
  • SPYXX.
  • SS3EDIT.
  • STOPSIGNAV.
  • SWAGENT.
  • SWDOCTOR.
  • SWNETSUP.
  • SYMLCSVC.
  • SYMPROXYSVC.
  • SYMSPORT.
  • SYMWSC.
  • SYNMGR.
  • TAUMON.
  • TBMON.
  • AVAST
  • TFAK.
  • THAV.
  • THSM.
  • TMAS.
  • TMLISTEN.
  • TMNTSRV.
  • TMPFW.
  • TMPROXY.
  • TNBUTIL.
  • TRJSCAN.
  • UP2DATE.
  • VBA32ECM.
  • VBA32IFS.
  • VBA32LDR.
  • VBA32PP3.
  • VBSNTW.
  • VCHK.
  • VCRMON.
  • VETTRAY.
  • VIRUSKEEPER.
  • VPTRAY.
  • VRFWSVC.
  • VRMONNT.
  • VRMONSVC.
  • VRRW32.
  • VSECOMR.
  • VSHWIN32.
  • VSMON.
  • VSSERV.
  • VSSTAT.
  • WATCHDOG.
  • WEBPROXY.
  • WEBSCANX.
  • WEBTRAP.
  • WGFE95.
  • WINAW32.
  • WINROUTE.
  • WINSS.
  • WINSSNOTIFY.
  • WRCTRL.
  • XCOMMSVR.
  • ZAUINST
  • ZLCLIENT
  • ZONEALARM


It then adds the following entry to the %Windir%\system.ini file:
[MCIDRV_VER]

The threat then checks the following URLs in order to download instructions which may instruct it to download other potentially malicious files onto the computer:
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)