TROJ64_WHAIM.A

Puede haberlo infiltrado otro malware.

Detalles de entrada

Puede haberlo infiltrado el malware siguiente:

• TROJ_WHAIM.A

Instalación

Crea las siguientes copias de sí mismo en el sistema afectado:

• %System%\{random file name}.dll
  where {random file name} can be any of the following:
  • bddsvc.dll
  • iconsvc.dll
  • ehressvc.dll
  • netstsvc.dll
  • pnas.dll
  • pnrpmchname.dll
  • pwpsvc.dll
  • pcssvc.dll
  • rregconf.dll
  • scardmngsvc.dll
  • tcpmsvc.dll
  • tschmng.dll
  • mmthread.dll
  • wcmngsvc.dll
  • coladj.dll
  • wndmodmng.dll
  • timesyncsvc.dll
  • wiredconfsvc.dll
  • wlanconf.dll
  • wstmng.dll

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows XP y Server 2003 en C:\Windows\System32).

Técnica de inicio automático

Registra el componente infiltrado como servicio del sistema para garantizar su ejecución automática cada vez que arranque el sistema. Para ello, crea las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
ImagePath = "%SystemRoot%\System32\svchost.exe -k {random service name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
DisplayName = "{display name}"
where {display name} can be any of the following:

• BitLocker Drive Decryption Service
• Internet Connection Service
• Media Center Service
• Network Storage Service
• Peer Networking Address
• PNRP Machine Name
• Power Policy
• Program Compatibility Service
• Remote Registry Configuration
• Smart Card Management Service
• Tablet PC Management Service
• Task Schedule Manager
• Thread Ordering Service
• WebClient Manage Service
• Windows Color Adjustment
• Windows Modules Management
• Windows Time Synchronization
• Wired Config Service
• WLAN Config Service
• Workstation management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
Description = "{service description}"
where {service description} can be any of the following:

• BDESVC hosts the BitLocker Drive Decryption service.
• Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
• Allows Media Center to locate and connect to the computer.
• This service delivers network notifications (e.
• Enables multi-party communication using Peer-to-Peer Connecting.
• This service publishes a machine name using the Peer Name Resolution Protocol.
• Manages power policy and power policy notification delivery.
• This service provides support for the Program Compatibility Assistant (PCA).
• Enables remote users to modify registry configurations on this computer.
• Manages access to smart cards read by this computer.
• Enables Tablet PC pen and ink functionality
• Enables a user to configure and schedule automated tasks on this computer.
• Provides ordered execution for a group of threads within a specific period of time.
• Enables Windows-based programs to create, access, and modify Internet-based files.
• The WcasPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules.
• Enables installation, modification, and removal of Windows updates and optional components.
• Maintains date and time synchronization on all clients and servers in the network.
• The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X
• Creates and maintains client network connections to remote server using the SMB protocol