BKDR_POISON.YZ

It monitors user activities and records messages posted to the system message queue which may include keystrokes to steal user information such as username and password.

This backdoor may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites. However, as of this writing, the said sites are inaccessible.

It opens a hidden Internet Explorer window. It connects to a website to send and receive information.

Arrival Details

This backdoor may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

However, as of this writing, the said sites are inaccessible.

Installation

This backdoor drops the following copies of itself into the affected system:

• %System%\winsysfig.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects threads into the following normal process(es):

• EXPLORER.EXE

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{A547F77A-E9DA-EA40-0ECE-D933375BD086}
StubPath = %System%\winsysfig.exe

Other System Modifications

This backdoor adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
bricks

Backdoor Routine

This backdoor opens a hidden Internet Explorer window.

It connects to the following websites to send and receive information:

• {BLOCKED}322b.3322.org

Other Details

This backdoor does the following:

• Monitors user activities and records messages posted to the system message queue, which may include keystrokes. As such, it may be able to steal user information such as user names and passwords.