TROJ_EXEDOT.SMA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It does not have any backdoor routine.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_DROPPER.OMJ

Autostart Technique

This Trojan registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_CLASSES_ROOT\Interface\{986A8AC1-AB4D-4F41-9068-4B01C0197867}

HKEY_CLASSES_ROOT\TypeLib\{8E3C68CD-F500-4A2A-8CB9-132BB38C3573}

HKEY_CLASSES_ROOT\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}

HKEY_CLASSES_ROOT\AppID\{A0E1054B-01EE-4D57-A059-4D99F339709F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}

HKEY_CLASSES_ROOT\AppID\main.DLL

HKEY_CLASSES_ROOT\main.BHO

HKEY_CLASSES_ROOT\main.BHO.1

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\
InProcServer32
(Default) = "{malware path and file name}.dll"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\‚”#˜‚

Backdoor Routine

This Trojan does not have any backdoor routine.

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• u.{BLOCKED}compile.com
• k.{BLOCKED}xad.com

It saves the files it downloads using the following names:

• %User Temp%\{random file name}.TMP
• %Current Folder%\{malware name}.sig

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan does the following:

• Checks and reports to the URLs above if the following processes are running in the system:
  • ACAAS.exe
  • ACAEGMr.exe
  • ACAIS.exe
  • ACALS.exe
  • ACASP.exe
  • AFMain.exe
  • AGIDSUI.exe
  • ALMon.exe
  • ALsvc.exe
  • APVXDWIN.EXE
  • AVGIDSAgent.exe
  • AVGIDSMonitor.exe
  • AVGIDSWatcher.exe
  • AhnSD.exe
  • AhnSDsv.exe
  • AluSchedulerSvc.exe
  • ApVxdWin.exe
  • CAGlobal.exe
  • CAGlobalLight.exe
  • CAPPActiveProtection.exe
  • CCSVCHST.EXE
  • CClaw.exe
  • CounterSpy.exe
  • EMLPROUI.EXE
  • EMLPROXY.EXE
  • FAMEH32.exe
  • FCH32.EXE
  • FPAVServer.exe
  • FProtTray.exe
  • FSM32.EXE
  • FSMA32.EXE
  • FSMB32.exe
  • HFACSvc.exe
  • HrRes.exe
  • IFace.exe
  • ISWSVC.exe
  • ITMRTSVC.exe
  • K7EmlPxy.exe
  • K7FWSrvc.exe
  • K7PSSrvc.exe
  • K7RTScan.exe
  • K7SysMon.exe
  • K7SysTry.exe
  • K7TSMngr.exe
  • K7TSecurity.exe
  • MSASCui.exe
  • MSProxy.ahn
  • McNASvc.exe
  • McProxy.exe
  • McSACore.exe
  • Mcshield.exe
  • MpfSrv.exe
  • MsMpEng.exe
  • Nbrowser.exe
  • Nip.exe
  • Njeeves.exe
  • Nsesvc.exe
  • Nvcoas.exe
  • ONLINENT.EXE
  • ONLNSVC.EXE
  • OPSSVC.EXE
  • OcHealthMon.exe
  • PAVSRV51.EXE
  • PPCtlPriv.exe
  • PSANHost.exe
  • PSHost.exe
  • PSUNMain.exe
  • PXAgent.exe
  • PXConsole.exe
  • PavBckPT.exe
  • PavFnSvr.exe
  • PavPrSrv.exe
  • PslmSvc.exe
  • QOELoader.exe
  • QUHLPSVC.EXE
  • RavMon.exe
  • RavTask.exe
  • RsTray.exe
  • SAVAdminService.exe
  • SBCSSvc.exe
  • SBCSTray.exe
  • SCANMSG.EXE
  • SCANWSCS.EXE
  • SavService.exe
  • SfCtlCom.exe
  • SpIDerAgent.exe
  • SpIDerMI.exe
  • TMBMSRV.exe
  • TRAYSSER.EXE
  • TSCFCommander.exe
  • TSCFPlatformCOMSvr.exe
  • TmPfw.exe
  • TmProxy.exe
  • UPSCHD.EXE
  • UfNai.exe
  • UfSeAgnt.exe
  • UfUpdUi.exe
  • UmxAgent.exe
  • UmxCfg.exe
  • UmxFwHlp.exe
  • UmxPol.exe
  • WEBPROXY.EXE
  • WinSSUI.exe
  • Zanda.exe
  • Zlh.exe
  • acs.exe
  • ashDisp.exe
  • ashMaiSv.exe
  • ashServ.exe
  • ashWebSv.exe
  • aswUpdSv.exe
  • avesvc.exe
  • avgam.exe
  • avgamsvr.exe
  • avgas.exe
  • avgcc.exe
  • avgcsrvx.exe
  • avgemc.exe
  • avgfws8.exe
  • avgnsx.exe
  • avgrsx.exe
  • avgtray.exe
  • avgupd.exe
  • avgupsvc.exe
  • avgwdsvc.exe
  • avgwsvc.exe
  • avp.exe
  • avpmapp.exe
  • avwebgrd.exe
  • caavguiscan.exe
  • capfasem.exe
  • cappactiveprotection.exe
  • casc.exe
  • casecuritycenter.exe
  • cavrid.exe
  • ccSvcHst.exe
  • ccschedulersvc.exe
  • cctray.exe
  • drwebscd.exe
  • egui.exe
  • ekrn.exe
  • elogsvc.exe
  • forsp.exe
  • fsaua.exe
  • fsav32.exe
  • fsavgui.exe
  • fsdfwd.exe
  • fsgk32.exe
  • fsgk32st.exe
  • fsguidll.exe
  • fspc.exe
  • fsqh.exe
  • fssm32.exe
  • fsus.exe
  • guard.exe
  • guardxkickoff.exe
  • guardxservice.exe
  • guardxup.exe
  • hcontain.exe
  • hpcsvc.exe
  • hsvcmod.exe
  • isafe.exe
  • livesrv.exe
  • mcagent.exe
  • mcmscsvc.exe
  • mcshell.exe
  • mcsysmon.exe
  • mcupdmgr.exe
  • mcvsmap.exe
  • mcvsshld.exe
  • mdmcls32.exe
  • msfwsvc.exe
  • msksrver.exe
  • npcsvc32.exe
  • npfsvc32.exe
  • npfuser.exe
  • nprosec.exe
  • nuaa.exe
  • nvcsched.exe
  • nvoy.exe
  • op_mon.exe
  • prevx.exe
  • psksvc.exe
  • qhfw.exe
  • rsnetsvr.exe
  • seccenter.exe
  • spiderml.exe
  • spidernt.exe
  • spidersgate.exe
  • spiderui.exe
  • svcprs32.exe
  • symlcsvc.exe
  • vba32ldr.exe
  • vbcmserv.exe
  • vbsystry.exe
  • vetmsg.exe
  • virCatch.exe
  • virusutilities.exe
  • vrfwsock.exe
  • vrfwsvc.exe
  • vrmonnt.exe
  • vrmonsvc.exe
  • vrrepair.exe
  • vrscan.exe
  • vsmon.exe
  • vsserv.exe
  • winss.exe
  • winssnotify.exe
  • xcommsvr.exe
  • zlclient.exe
• It does not have rootkit capabilities.