TROJ_SISRON.AK
Trojan:Win32/Sisron (Microsoft); Generic.bfr!ce (McAfee); Trojan.Gen.2 (Symantec); Trojan.Win32.Genome.tiix (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Trojan.Agent.27273 (FSecure)
Windows 2000, Windows XP, Windows Server 2003
Tipo de malware
Trojan
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
Detalles técnicos
Otras modificaciones del sistema
Agrega las siguientes entradas de registro como parte de la rutina de instalación:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonBadCertRecving = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
CertificateRevocation = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonZoneCrossing = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
Manager = "{malware path and file name}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
win = "{malware path and file name}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
init = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Use FormSuggest = "yes"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Use FormSuggest = "yes"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
DisableScriptDebuggerIE = "yes"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Error Dlg Displayed On Every Error = "no"
HKEY_CLASSES_ROOT
.grp = "MSProgramGroup"
HKEY_CLASSES_ROOT
MSProgramGroup = "Microsoft Program Group"
HKEY_CLASSES_ROOT
MSProgramGroup\Shell\Open\Command = "%System%\grpconv.exe %1"
Modifica las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is 2.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1601 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Disable Script Debugger = "yes"
(Note: The default value data of the said registry entry is no.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AeDebug
Auto = "0"
(Note: The default value data of the said registry entry is 0.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "Init Application."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "bdg: ..."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "bdg: Done."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "dros: ..."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "dros: Renames."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "dros: Copies."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "dros: Deletes."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "dros: Done."
(Note: The default value data of the said registry entry is Uninit Application..)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "Uninit Application."
(Note: The default value data of the said registry entry is Uninit Application..)
Elimina las siguientes claves de registro:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden\
Policy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
Rutina de infiltración
Infiltra los archivos siguientes:
- %Temp%\Plug.bat
- %Temp%\driver.inf
(Nota: %Temp% es la carpeta de archivos temporales de Windows, que suele estar en C:\Windows\Temp o C:\WINNT\Temp).
)
Soluciones
Step 1
Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.
Step 2
Eliminar esta clave del Registro
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- Run
Step 3
Eliminar este valor del Registro
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnonBadCertRecving = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- CertificateRevocation = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnonZoneCrossing = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnOnPostRedirect = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- ShowSuperHidden = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- Manager = "{malware path and file name}.exe"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- win = "{malware path and file name}"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- init = "{malware path and file name}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- Use FormSuggest = "yes"
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Use FormSuggest = "yes"
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- DisableScriptDebuggerIE = "yes"
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Error Dlg Displayed On Every Error = "no"
- In HKEY_CLASSES_ROOT
- .grp = "MSProgramGroup"
- In HKEY_CLASSES_ROOT
- MSProgramGroup = "Microsoft Program Group"
- In HKEY_CLASSES_ROOT
- MSProgramGroup\Shell\Open\Command = "%System%\grpconv.exe %1"
Step 4
Restaurar este valor del Registro modificado
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = "2"
To: Hidden = ""2""
- From: Hidden = "2"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- SuperHidden = "1"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- From: 1601 = "0"
To: 1601 = ""1""
- From: 1601 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Disable Script Debugger = "yes"
To: Disable Script Debugger = ""no""
- From: Disable Script Debugger = "yes"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
- From: Auto = "0"
To: Auto = ""0""
- From: Auto = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "Init Application."
To: Log = ""Uninit Application.""
- From: Log = "Init Application."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "bdg: ..."
To: Log = ""Uninit Application.""
- From: Log = "bdg: ..."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "bdg: Done."
To: Log = ""Uninit Application.""
- From: Log = "bdg: Done."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "dros: ..."
To: Log = ""Uninit Application.""
- From: Log = "dros: ..."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "dros: Renames."
To: Log = ""Uninit Application.""
- From: Log = "dros: Renames."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "dros: Copies."
To: Log = ""Uninit Application.""
- From: Log = "dros: Copies."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "dros: Deletes."
To: Log = ""Uninit Application.""
- From: Log = "dros: Deletes."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "dros: Done."
To: Log = ""Uninit Application.""
- From: Log = "dros: Done."
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv
- From: Log = "Uninit Application."
To: Log = ""Uninit Application.""
- From: Log = "Uninit Application."
Step 5
Buscar y eliminar estos archivos
- %Temp%\Plug.bat
- %Temp%\driver.inf
Step 6
Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como TROJ_SISRON.AK En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.
Rellene nuestra encuesta!