TROJ_ADLOAD.MT

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• ％System Root%\Documents and Settings\All Users\Start Menu\Programs\Startup\ktv.lnk
• ％User Temp%\fvq4.tmp
• ％User Temp%\h8nil4o8\4.dll
• ％User Temp%\h8nil4o8\b.dll.zgx
• ％User Temp%\h8nil4o8\b.dll.zgx.tmp
• ％User Temp%\h8nil4o8\mtv.exe
• ％User Temp%\h8nil4o8\mtv.exe.tmp
• ％User Temp%\h8nil4o8\p.dll.zgx
• ％User Temp%\h8nil4o8\s.exe
• ％User Temp%\h8nil4o8\s.exe.tmp
• ％User Temp%\h8nil4o8\z.lz
• ％User Temp%\h8nil4o8\_uninstall
• ％User Temp%\hek\2.tmp
• ％User Temp%\hek\tmp.exe
• ％User Temp%\hek\tmp.exe.tmp
• ％User Temp%\hek\_uninstall
• %Windows%\df9d.flv
• %Windows%\Tasks\ms.job
• %System%\-1249041-125
• %System%\2bed.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %User Temp%\h8nil4o8
• %User Temp%\hek

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
ImagePath = "%System%\2bed.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
DisplayName = "OSTD"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\OSTD
ObjectName = "LocalSystem"

Dropping Routine

This Trojan drops the following files:

• %User Temp%\h8nil4o8\p.dll.zgx.tmp - detected as TROJ_RUGO.SM

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}p.demisetoken.com/t8.exe