TROJ_ANOMALY.AU
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
TECHNICAL DETAILS
8,704 bytes
PE
UPX
No
21 Jul 2009
Other System Modifications
This Trojan adds the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\BAP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\PPP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASBACP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASCCP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASEAP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPCP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPHLP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASMAN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASPAP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASQEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASSPAP
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASTAPI
It adds the following registry entries as part of its installation routine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\BAP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\BAP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\PPP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\PPP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASBACP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASBACP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASCCP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASCCP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASEAP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASEAP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPCP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPCP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPHLP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASIPHLP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASMAN
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASMAN
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASPAP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASPAP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASQEC
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASQEC
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASSPAP
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASSPAP
FileDirectory = "%Windows%\tracing"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASTAPI
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\RASTAPI
FileDirectory = "%Windows%\tracing"
SOLUTION
8.900
6.298.01
21 Jul 2009
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- BAP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- PPP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASBACP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASCCP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASEAP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASIPCP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASIPHLP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASMAN
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASPAP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASQEC
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASSPAP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing
- RASTAPI
Step 3
Scan your computer with your Trend Micro product to delete files detected as TROJ_ANOMALY.AU. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.