TROJ_RANSOM.PB

This Trojan bears the file icons of certain applications to avoid easy detection and consequent removal.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Installation

This Trojan drops the following files:

• %User Temp%\{random numbers}.exe - detected as WORM_OTORUN.QWAW

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random folder name}\csrss.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It bears the file icons of the following applications:

• Adobe PDF document

It creates the following folders:

• %Application Data%\{random folder name}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "explorer.exe "%Application Data%\{random folder name}\csrss.exe""

(Note: The default value data of the said registry entry is Explorer.exe .)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Application Data%\{random folder}\csrss.exe = "%Application Data%\{random folder}\csrss.exe:*:Enabled:ldrsoft"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings
ProxyEnable = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = "58"

(Note: The default value data of the said registry entry is 56.)

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.