TROJ_DLOADER.UQY

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.

This file contains a URL where it connects to possibly download other files. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded from remote site(s) by the following malware:

• JAVA_BLACOLE.EV

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\V3LiveRun.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
AhnLab V3Lite Update Process = "%System%\V3LiveRun.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\Help
Help Version = "{Random}"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKLM\Software\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "ws2help.dll"

(Note: The default value data of the said registry entry is "".)

Other Details

This file contains a URL where it connects to possibly download other files. As of this writing, this file contains the following URLs:

• sourceforge.net/users/{BLOCKED}511
• {BLOCKED}is.co.kr/h.gif

It deletes itself after execution.

NOTES:

This Trojan modifies the following file by adding an export function:

• %System%\ws2help.dll