TROJ_MONKIF.AE

This malware checks for specific running processes in the affected system.

It connects to specific URLs in order to download malicious files.

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan drops the following files:

• %User Temp%\{random file name}.tmp - also detected as TROJ_MONKIF.AE
• %User Temp%\msfat32 - also detected as TROJ_MONKIF.AE

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Local\UIEI

Autostart Technique

This Trojan adds the following registry keys to install itself as a Browser Helper Object (BHO):

HKEY_CLASSES_ROOT\CLSID\{random CLSID}

HKEY_CLASSES_ROOT\PROTOCOLS\Filter\
text/html

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{random CLSID}
(Default) = %User Temp%\msfat32

HKEY_CLASSES_ROOT\CLSID\{random CLSID}
ThreadingModel = Apartment

HKEY_CLASSES_ROOT\PROTOCOLS\Filter\
text/html
CLSID = {random CLSID}

HKEY_CLASSES_ROOT\PROTOCOLS\Filter\
text/html
(Default) = Microsoft Improved HTML MIME Filter

NOTES:
It enumerates all running processes to check if any of the following are running:

• ACAAS.exe
• ACAEGMr.exe
• ACAIS.exe
• ACALS.exe
• ACASP.exe
• acs.exe
• AFMain.exe
• AGIDSUI.exe
• AhnSD.exe
• AhnSDsv.exe
• ALMon.exe
• ALsvc.exe
• AluSchedulerSvc.exe
• ApVxdWin.exe
• ashDisp.exe
• ashMaiSv.exe
• ashServ.exe
• ashWebSv.exe
• aswUpdSv.exe
• avesvc.exe
• avgam.exe
• avgamsvr.exe
• avgas.exe
• avgcc.exeexe
• avgcsrvx.exe
• avgemc.exe
• avgfws8.exe
• AVGIDSAgent.exe
• AVGIDSMonitor.exe
• AVGIDSWatcher.exe
• avgnsx.exe
• avgrsx.exe
• avgtray.exe
• avgupd.exe
• avgupsvc.exe
• avgwdsvc.exe
• avgwsvc.exeavp.exe
• avpmapp.exe
• avwebgrd.exe
• caavguiscan.exe
• CAGlobal.exe
• CAGlobalLight.exe
• capfasem.exe
• cappactiveprotection.exe
• casc.exe
• casecuritycenter.exe
• cavrid.exe
• CClaw.exe
• ccschedulersvc.exe
• CCSVCHST.EXE
• cctray.exe
• CounterSpy.exe
• drwebscd.exe
• egui.exe
• ekrn.exe
• elogsvc.exe
• EMLPROUI.EXE
• EMLPROXY.EXE
• FAMEH32.exe
• FCH32.EXE
• ForceField.exe
• forsp.exe
• FPAVServer.exe
• FProtTray.exe
• fsaua.exe
• fsav32.exe
• fsavgui.exe
• fsdfwd.exe
• fsgk32.exe
• fsgk32st.exe
• fsguidll.exe
• FSM32.EXE
• FSMA32.EXE
• FSMB32.exe
• fspc.exe
• fsqh.exe
• fssm32.exe
• fsus.exe
• guard.exe
• guardxkickoff.exe
• guardxservice.exe
• guardxup.exe
• hcontain.exe
• HFACSvc.exe
• hpcsvc.exe
• HrRes.exe
• hsvcmod.exe
• IFace.exe
• isafe.exe
• ISWSVC.exe
• ITMRTSVC.exe
• K7EmlPxy.exe
• K7FWSrvc.exe
• K7PSSrvc.exe
• K7RTScan.exe
• K7SysMon.exe
• K7SysTry.exe
• K7TSecurity.exe
• K7TSMngr.exe
• livesrv.exe
• mcagent.exe
• mcmscsvc.exe
• McNASvc.exe
• McProxy.exe
• McSACore.exe
• mcshell.exe
• Mcshield.exe
• mcsysmon.exe
• mcupdmgr.exe
• mcvsmap.exee
• mcvsshld.exe
• mdmcls32.exe
• MpfSrv.exe
• MSASCui.exe
• msfwsvc.exe
• msksrver.exe
• MsMpEng.exe
• MSProxy.ahn
• Nbrowser.exe
• Nip.exe
• Njeeves.exe
• npcsvc32.exe
• npfsvc32.exe
• npfuser.exe
• nprosec.exe
• Nsesvc.exe
• nuaa.exe
• Nvcoas.exe
• nvcsched.exe
• nvoy.exe
• OcHealthMon.exe
• ONLINENT.EXE
• ONLNSVC.EXE
• op_mon.exe
• OPSSVC.EXE
• PavBckPT.exe
• PavFnSvr.exe
• PavPrSrv.exe
• PAVSRV51.EXE
• PPCtlPriv.exe
• prevx.exe
• PSANHost.exe
• PSHost.exe
• psksvc.exe
• PslmSvc.exe
• PSUNMain.exe
• PXAgent.exe
• PXConsole.exe
• qhfw.exe.EXE
• QOELoader.exe
• QUHLPSVC.EXE
• RavMon.exe
• RavTask.exe
• rsnetsvr.exe
• RsTray.exexe
• SAVAdminService.exe
• SavService.exe
• SBCSSvc.exe
• SBCSTray.exe
• SCANMSG.EXE
• SCANWSCS.EXE
• seccenter.exe
• SfCtlCom.exe
• SpIDerAgent.exe
• SpIDerMI.exe
• spiderml.exe
• spidernt.exe
• spidersgate.exe
• spiderui.exe
• svcprs32.exe
• symlcsvc.exe
• TMBMSRV.exe
• TmPfw.exe
• TmProxy.exe
• TRAYSSER.EXE
• TSCFCommander.exe
• TSCFPlatformCOMSvr.exe
• UfNai.exe
• UfSeAgnt.exe
• UfUpdUi.exe
• UmxAgent.exe
• UmxCfg.exe
• UmxFwHlp.exe
• UmxPol.exe
• UPSCHD.EXE
• vba32ldr.exe
• vbcmserv.exe
• vbsystry.exe
• vetmsg.exe
• virCatch.exe
• virusutilities.exe
• vrfwsock.exe
• vrfwsvc.exe
• vrmonnt.exe
• vrmonsvc.exe
• vrrepair.exe
• vrscan.exe
• vsmon.exe
• vsserv.exe
• WEBPROXY.EXE
• winss.exe
• winssnotify.exe
• WinSSUI.exe
• xcommsvr.exe
• Zanda.exe
• zlclient.exe
• Zlh.exe
• vmacthlp.exe
• VMwareService.exe
• VMwareTray.exe
• VMwareUser.exe
• SBAMSvc.exee
• SBAMTray.exe
• sbamui.exexe
• BDTUpdateService.exe
• pctsAuxs.exe
• pctsSvc.exe
• pctsTray.exe
• TFService.exe
• pctsGui.exe
• AVKProxy.exe
• AVKService.exe
• AVKTray.exe
• AVKWCtl.exe
• GDFirewallTray.exe
• GDFwSvc.exe
• GDSC.exe
• GDScan.exe
• GDScan.exe
• THAV.EXE
• THD32.EXE
• THSM.EXE
• dvpapi.exe
• syssvcnt.exe
• avgui.exe
• avinitnt.exe
• avtray.exe
• dvprpt.exe
• untray.exe
• WRConsumerService.exe
• SpySweeper.exe
• SpySweeperUI.exe
• SSU.exe
• SSU.exe
• uiscan.exe
• livesrv.exe
• vsserv.exe
• seccenter.exe
• MWAGENT.EXE
• escanmon.exe
• CONSCTL.EXE
• MWASER.EXE
• econceal.exe
• econser.exe
• MAILDISP.EXE
• TRYICOS.EXE
• tpcfg.exe
• tppfdmm.exe
• avmgma.exe
• avas.exe
• gozer.exe
• TDWatch.exe
• tptray.exe
• avcom.exe
• avcom.exe
• a2services.exe
• a2guard.exe
• a2start.exe
• cmdagent.exe
• cfp.exet.exe
• TeaTimer.exe
• SpybotSD.exe
• AAWService.exe
• AAWTray.exe
• Ad-Aware.exe
• AGB6.exe.exe
• AGBKrnl.exe
• ALive.exe
• ACenter.exe
• AScheduleService.exe
• kpfw32.exe
• kavstart.exe
• kwatch.exe
• kpfwsvc.exe
• kmailmon.exe
• kissvc.exe
• Arcabit.Core.LoggingService.exe
• arcarvir.exe
• ABregmon.exe
• AVMenu.exe
• ARCATA~1.EXE
• ArcaBackupService.exe
• ArcaRemoteSvc.exe
• ArcaBit.Core.Configurator2.exe
• NetMonSV.exe
• FileMonSV.exe
• KVMonXp.kxp
• KVXp.kxp
• KVSrvXP.exe
• msseces.exe
• MsMpEng.exe

• www.{BLOCKED}ies.com/photo/{random characters}.php?{random characters}={encrypted code for the running processes}