TROJ_GERAL.BN

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\kav.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It creates the following folders:

• %Program Files%\KAV

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
kav = "%System%\kav.exe"

It adds the following Image File Execution Options registry entries to automatically execute itself whenever certain applications are run:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}
{application} = "svchost.exe"

Other System Modifications

This Trojan adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}

Where {application name} may be any of the following:

• uDongFangYu.exe
• 360Safebox.exe
• 360SoftMgrSvc.exe
• 360delays.exe
• 360realpro.exe
• 360rp.exe
• 360safe.exe
• 360sd.exe
• 360tray.exe
• AgentSvr.exe
• CCenter.exe
• DSMain.exe
• DrUpdate.exe
• DrvAnti.exe
• FrameworkService.exe
• KABackReport.exe
• KISSvc.exe
• KPFW32.exe
• KPfwSvc.exe
• KSWebShield.exe
• KVSrvXP.exe
• KWatch.exe
• KavStart.exe
• LiveUpdate360.exe
• MPMon.exe
• MPSVC.exe
• MPSVC1.exe
• MPSVC2.exe
• McProxy.exe
• McTray.exe
• MpfSrv.exe
• QQDoctor.exe
• QQDoctorRtp.exe
• QQDrNetMon.exe
• Rav.exe
• RavMon.exe
• RavMonD.exe
• RavStub.exe
• RavTask.exe
• RegGuide.exe
• RsAgent.exe
• RsTray.exe
• SHSTAT.exe
• ScanFrm.exe
• Uplive.exe
• XsClient.exe
• alg.exe
• antiarp.exe
• avp.exe
• bdagent.exe
• ccEvtMgr.exe
• ccSetMgr.exe
• ccSvcHst.exe
• ccapp.exe
• defwatch.exe
• egui.exe
• ekrn.exe
• engineserver.exe
• kaccore.exe
• kmailmon.exe
• livesrv.exe
• mcagent.exe
• mcinsupd.exe
• mcmscsvc.exe
• mcnasvc.exe
• mcshell.exe
• mcshield.exe
• mcsysmon.exe
• mcupdmgr.exe
• mfeann.exe
• mfevtps.exe
• naPrdMgr.exe
• nbmanti.exe
• qutmserv.exe
• rfwsrv.exe
• rsnetsvr.exe
• rssafety.exe
• rtvscan.exe
• safeboxTray.exe
• udaterui.exe
• vptray.exe
• vsserv.exe
• vstskmgr.exe
• xcommsvr.exe

Dropping Routine

This Trojan drops the following files:

• %User Temp%\{random}.exe
• %System%\jxgamepacik.pak
• %System%\drivers\TvPlus.sys

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}sdns.com:18184/c/d.txt
• http://{BLOCKED}sdns.com:18184/c/host.txt
• http://{BLOCKED}12tj.com:18888/57/tj.asp?mac={mac address}&ver={version}&os={OS}&dtime={date}