TROJ_GERAL.SMW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\scvhost.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
RsTray = "%System%\scvhost.exe"

It adds the following Image File Execution Options registry entries to automatically execute itself whenever certain applications are run:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}
{application} = "svchost.exe"

Other System Modifications

This Trojan adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}

Where {application name} may be any of the following:

• 360Safebox.exe
• 360tray.exe
• AgentSvr.exe
• CCenter.exe
• DrUpdate.exe
• FrameworkService.exe
• KISSvc.exe
• KPFW32.exe
• KPfwSvc.exe
• KVSrvXP.exe
• KWatch.exe
• KavStart.exe
• MPMon.exe
• MPSVC.exe
• MPSVC1.exe
• MPSVC2.exe
• McProxy.exe
• McTray.exe
• MpfSrv.exe
• QQDoctor.exe
• QQDoctorRtp.exe
• Rav.exe
• RavMon.exe
• RavMonD.exe
• RavStub.exe
• RavTask.exe
• RegGuide.exe
• RsAgent.exe
• RsTray.exe
• SHSTAT.exe
• ScanFrm.exe
• Uplive.exe
• antiarp.exe
• avp.exe
• bdagent.exe
• ccEvtMgr.exe
• ccSetMgr.exe
• ccSvcHst.exe
• ccapp.exe
• defwatch.exe
• egui.exe
• ekrn.exe
• engineserver.exe
• kmailmon.exe
• livesrv.exe
• mcagent.exe
• mcinsupd.exe
• mcmscsvc.exe
• mcnasvc.exe
• mcshell.exe
• mcshield.exe
• mcsysmon.exe
• mcupdmgr.exe
• mfeann.exe
• mfevtps.exe
• naPrdMgr.exe
• rfwsrv.exe
• rsnetsvr.exe
• rtvscan.exe
• safeboxTray.exe
• udaterui.exe
• vptray.exe
• vsserv.exe
• vstskmgr.exe
• xcommsvr.exe
• xcommsvr.exe

Dropping Routine

This Trojan drops the following files:

• %Windows%\extext{random}t.exe
• %System%\drivers\pcidump.sys

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}re.cn/xx8/Count.asp?mac={mac address}&ver={version}&os={OS}
• http://{BLOCKED}3.cn/xx8/ttnew.txt