TROJ_GENOME.APH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\ebms.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %System%\ax

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects codes into the following process(es):

• svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce
fum = "%System%\ebms.exe"

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan checks for the presence of the following process(es):

• avp.exe
• pccguide.exe
• RavMon.exe
• fsguidll.exe

NOTES:

This malware checks if the found process is located on the following folder:

• For avp.exe:
  • Kaspersky Internet Security 7.0
  • Kaspersky Anti-Virus 7.0
• For pccguide.exe:
  • Trend Micro\Internet Security 2007
• For RavMon.exe:
  • Rising\Rav\
• For fsguidll.exe:
  • F-Secure\FSGUI\

If the above processes are not found, this malware drops the following file:

• %System%\fgsm.sys - detected as RTKT_BUREY.T

If the above processes are found, it drops the following file:

• %User Temp%\ssmger.sys - detected as RTKT_BUREY.T

This malwarel replaces the file %System%\drivers\beep.sys with %User Temp%\ssmger.sys.

This malware does not exploit any vulnerability.

It deletes the initially executed copy of itself