VBS_KILLAV.AID

This Trojan modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.

Arrival Details

This Trojan may be downloaded from the following remote sites:

• 222

Installation

This Trojan drops the following files:

• %Windows%\search.reg - reg data file component
• %Windows%\.reg - reg data file component
• %Windows%\SetWindowsIndex.reg - reg data file component
• %Windows%\MYShowIeLinkIe6.reg - reg data file component
• %Windows%\MyShowIeLinkIe7.reg - reg data file component
• %Windows%\AddRight.reg - reg data file component
• %System Root%\Documents and Settings\All Users\Desktop\{random}.tt - non-malicious file
• %System Root%\Documents and Settings\All Users\Desktop\{garbage characters}.bt - non-malicious file
• %System Root%\Documents and Settings\All Users\Start Menu\Programs\Internet Explorer.css - non-malicious file
• %System Root%\Documents and Settings\All Users\Start Menu\Programs\Startup\360vbs.jse - non-malicious file
• %Favorites%\{garbage characters}.url - non-malicious file
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.css - non-malicious file

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Windows%\{random}.vbs

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\.bt

HKEY_CLASSES_ROOT\css

HKEY_CLASSES_ROOT\shb

HKEY_CLASSES_ROOT\tt

HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309A}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\MenuExt\{garbage characters}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.bt

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.tt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Desktop\NameSpace\{871C5380-42A0-1069-A2EA-08002B30309A}

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden1 = 2

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\WebBrowser
ITBar7Layout = {hex values}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\WebBrowser
{B580CF65-E151-49C3-B73F-70B13FCA8E86} = {hex values}

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\WebBrowser
{F2CF5485-4E02-4F68-819C-B92DE9277049} = {hex values}

It modifies the following registry entries:

HKEY_CLASSES_ROOT\.css
@ = css

(Note: The default value data of the said registry entry is CSSfile.)

HKEY_CLASSES_ROOT\.shb
@ = shb

(Note: The default value data of the said registry entry is DocShortcut.)

HKEY_CLASSES_ROOT\http\shell\
open\command
@ = "C:\Program Files\Internet Explorer\iexplore.exe" http://dianxin.online.cq.cn/api/http/index.htm? %1

(Note: The default value data of the said registry entry is "C:\Program Files\Internet Explorer\iexplore.exe" -nohome.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar
LinksFolderName = Á´½Ó

(Note: The default value data of the said registry entry is Links.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

Web Browser Home Page and Search Page Modification

This Trojan modifies the user's Internet Explorer home page to the following websites:

• http://www.{BLOCKED}g1234.com/?my=0