PE_PAGIPEF.BY

 Analysis by: Adrianne Chester Camat

 ALIASES:

Win32/Xorer (NAI), Virus:Win32/Xorer.gen!A (Microsoft)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet, Via removable drives, Infects files


This file infector arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It prepends its codes to target files. It infects certain file types by inserting code in the said files.

It drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

94,216 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

28 Mar 2008

Payload:

Displays ads

Arrival Details

This file infector arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector drops and executes the following files:

  • %system%\com\lsass.exe detected as PE_PAGIPEF.BY
  • %system%\com\netcfg.dll detected as TROJ_PAGIPEF.BY
  • %system%\com\netcfg.000 detected as TROJ_PAGIPEF.BY
  • %system%\com\smss.exe detected as TROJ_PAGIPEF.BL

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • xcgucvnzn

Autostart Technique

This file infector registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\NetApi000

It adds and runs the following services:

  • Netapi000

Other System Modifications

This file infector modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = "91"

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
Type = "radio"

(Note: The default value data of the said registry entry is checkbox.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run

File Infection

This file infector prepends its codes to target files.

It infects files with the following file extensions by inserting code in the said files:

  • *.exe

Propagation

This file infector drops copies of itself in all removable and physical drives found in the system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

asdfasdf

Adware Routine

This file infector connects to the following URLs to download and display ads:

  • http://js.{BLOCKED}2.com/go.asp
  • http://ww2.js.{BLOCKED}2.com/go.asp
  • http://w.{BLOCKED}o.com/r.htm
  • http://ww38.w.{BLOCKED}o.com/r.htm
  • http://js.{BLOCKED}2.com/01.asp

Other Details

This file infector closes application windows that contain the following strings in the title bar:

  • rav
  • avp
  • twister
  • kv
  • watch
  • kissvc
  • scan
  • guard
  • kmailmon
  • 360¦¦+½
  • lsass.exe
  • smss.exe
  • pagefile.pif
  • dr.web
  • firewall
  • escan
  • mcagent
  • yst
  • afet
  • onit
  • kv
  • monitor
  • ewido
  • bitdefender
  • facelesswndproc
  • avg
  • arp
  • mcafee
  • afx:
  • eset
  • thunderrt6main
  • thunderrt6formdc
  • ThunderRT6Timer
  • antivir
  • tapplication
  • AfxControlBar42s
  • TsuiForm
  • copylock
  • avast
  • ##vso##
  • TPageControl
  • TTabSheet
  • diskgen
  • dummycom
  • xorer
  • ieframe
  • cabinetwclass
  • mozillauiwindowclass
  • metapad
  • AntiVirService
  • AVP
  • KWatchSvc
  • ekrn
  • SymEvent
  • PAVSRV
  • tmmbd
  • McShield
  • RsRavMon
  • EQService
  • KSysMon

  SOLUTION

Minimum Scan Engine:

9.300

FIRST VSAPI PATTERN FILE:

5.192.01

FIRST VSAPI PATTERN DATE:

28 Mar 2008

VSAPI OPR PATTERN File:

5.193.00

VSAPI OPR PATTERN Date:

31 Mar 2008

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Remove malware/grayware files dropped/downloaded by PE_PAGIPEF.BY

    • TROJ_PAGIPEF.BL
    • TROJ_PAGIPEF.BY

Step 3

Since this malware cannot be removed in normal and safe mode, it is necessary to restart using the Windows Recovery Console. To restart the system using the Windows Recovery Console:

• On Windows XP and Server 2003 systems:

  1. Click Start>Run. In the Open input box, type secpol.msc and press Enter.
  2. In the left panel, double-click Local Policies>Security Options.
  3. In the right panel, double-click Recovery Console: Allow floppy copy and access to all drives and folders.
  4. Select Enabled and click OK.
  5. Insert the Windows Installation CD into the CD drive, then restart your computer.
  6. When prompted, press any key to boot from the CD.
  7. On the main menu, type r to go to the Recovery Console.
  8. Type the number that corresponds to the drive and directory that contains Windows (usually C:\WINDOWS) and press Enter.
  9. Type the Administrator password and press Enter.
  10. In the input box, type the following then press Enter:
    SET AllowAllPaths = TRUE
    del "%System%\Com\lsass.exe"
    del "%System%\Com\smss.exe"
  11. Type exit and press Enter to restart the system normally.

• On Windows Vista and 7 systems:

  1. Insert your Windows Installation DVD in the DVD drive, then Press the restart button.
  2. When prompted, press any key to boot from the DVD.
  3. Depending on your Windows Installation DVD, you might be required to select the installation language. Then on the Install Windows window, choose your language, locale, and keyboard layout or input method. Click Next, then click Repair your computer.
  4. Select Use recovery tools that can help fix problems starting Windows. Select your installation of Windows. Click Next.
  5. If the Startup Repair window appears, click Cancel, Yes, then Finish.
  6. In the System Recovery Options window, click Command Prompt.
  7. In the Command Prompt window, type the following then press Enter:
    del "%System%\Com\lsass.exe"
    del "%System%\Com\smss.exe"

    (Note: In Windows 7, all local drives will be assigned one more than normal. For example, the C: drive becomes D:.)
  8. Type exit and press Enter to close the Command Prompt window.
  9. Click Restart to restart the system normally.

Step 4

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
    • NetApi000

Step 5

Restoring Deleted Registry Keys

  1. Still in Registry Editor, in the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>
    Control>SafeBoot>Minimal
  2. Right-click on the key and choose New>Key. Change the value of the new key to:
    {4D36E967-E325-11CE-BFC1-08002BE10318}
  3. Right-click on the value name and choose Modify. Change the value data of this entry to:
    DiskDrive
  4. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>
    Control>SafeBoot>Network
  5. Right-click on the key and choose New>Key. Change the value of the new key to:
    {4D36E967-E325-11CE-BFC1-08002BE10318}
  6. Right-click on the value name and choose Modify. Change the value data of this entry to:
    DiskDrive
  7. Close Registry Editor.

Step 6

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: ShowSuperHidden = "0"
      To: ShowSuperHidden = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
    • From: Type = "radio"
      To: Type = "checkbox"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • From: NoDriveTypeAutoRun = "91"
      To: NoDriveTypeAutoRun = "{user defined}"

Step 7

Search and delete AUTORUN.INF files created by PE_PAGIPEF.BY that contain these strings

[ Learn More ]
[AutoRun]
open=pagefile.pif
shell\open=[garbage text]
shell\open\Command=pagefile.pif
shell\open\Default=1
shell\explore=[garbage text]
shell\explore\Command=pagefile.pif

Step 8

Scan your computer with your Trend Micro product to clean files detected as PE_PAGIPEF.BY. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Did this description help? Tell us how we did.