PE_LOOKED.SE-O

.

This file infector may be dropped by other malware.

It injects its dropped file/component to specific processes.

It prepends its codes to target files.

As of this writing, the said sites are inaccessible.

Arrival Details

This file infector may be dropped by the following malware:

• PE_LOOKED.SE

Installation

This file infector drops the following file(s)/component(s):

• %Windows%\RichDll.dll - detected as Mal_Xed-4

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It drops the following non-malicious files:

• %System Root%\_desktop.ini - contains date of infection

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %Windows%\uninstall\rundl132.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders:

• %Windows%\uninstall

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It injects its dropped file/component to the following processes:

• explorer.exe

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
load = "%Windows%\uninstall\rundl132.exe"

Other System Modifications

This file infector adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Soft\
DownloadWWW

HKEY_LOCAL_MACHINE\SOFTWARE\Soft

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Soft\
DownloadWWW
auto = "1"

File Infection

This file infector infects the following file types:

• .EXE

It prepends its codes to target files.

It searches for target files in the following drives:

• C to Z

It avoids infecting folders containing the following strings:

• Common Files
• ComPlus Applications
• Documents and Settings
• InstallShield Installation Information
• Internet Explorer
• Messenger
• Microsoft Frontpage
• Microsoft Office
• Movie Maker
• MSN Gaming Zone
• NetMeeting
• Outlook Express
• Recycled
• system
• System Volume Information
• system32
• windows
• Windows Media Player
• Windows NT
• WindowsUpdate
• winnt

This is the Trend Micro detection for files infected by:

• PE_LOOKED.SE

Process Termination

This file infector terminates the following processes if found running in the affected system's memory:

• EGHOST.EXE
• MAILMON.EXE
• KAVPFW.EXE
• KAVPFW.EXE
• IPARMOR.EXE
• Ravmond.EXE
• regsvc.exe
• RavMon.exe
• mcshield.exe
• KVMonXP.KXP
• KRegEx.exe
• KVXP.KXP

Download Routine

This file infector accesses the following websites to download files:

• www.54699.com/{1-10}.txt

As of this writing, the said sites are inaccessible.

NOTES:

It prioritizes infection on the following executables:

• ACDSee4.exe
• ACDSee5.exe
• ACDSee6.exe
• AgzNew.exe
• Archlord.exe
• AutoUpdate.exe
• autoupdate.exe
• autoupdate.exe
• BNUpdate.exe
• Datang.exe
• editplus.exe
• EXCEL.EXE
• flashget.exe
• foxmail.exe
• FSOnline.exe
• GameClient.exe
• install.exe
• jxonline_t.exe
• launcher.exe
• launcher.exe
• lineage.exe
• LineageII.exe
• MHAutoPatch.exe
• Mir.exe
• msnmsgr.exe
• msnmsgr.exe
• Mu.exe
• my.exe
• NATEON.exe
• NSStarter.exe
• Patcher.exe
• patchupdate.exe
• QQ.exe
• Ragnarok.exe
• Ragnarok.exe
• realplay.exe
• run.exe
• setup.exe
• Silkroad.exe
• Thunder.exe
• ThunderShell.exe
• TTPlayer.exe
• Uedit32.exe
• Winrar.exe
• WINWORD.EXE
• woool.exe
• zfs.exe

It then infects all executables in directories and subdirectories that do not have any of the executables.

This malware attempts to propagate via network shares. It uses administrator as its user name to gain access to the following default shares:

• ADMIN$
• IPC$