TROJ_RISK.FN

It drops a .SYS file, which is an encrypted file decrypted by its main component in memory to perform its intended routine.

When successfully installed on the affected system, it may connect to the Internet to download possibly malicious files.

As a result, malicious routines of the downloaded files may be exhibited on the affected system.

This Trojan may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware/spyware from remote sites.

It executes then deletes itself afterward.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan drops the following file(s)/component(s):

• %System%\drivers\usbine.sys - also detected TROJ_RISK.FN

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\ctfnom.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It executes then deletes itself afterward.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
twin = "%System%\ctfnom.exe"

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.