BKDR_FYNLOSKI.CI

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies files, disabling programs and applications from properly running. It disables Task Manager, Registry Editor, and Folder Options.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor creates the following folders:

• %User Profile%\Application Data\dclogs
• %System Root%\DOCUME~1
• %System Root%\DOCUME~1\Wilbert
• %User Profile%\LOCALS~1
• %User Temp%\nsk3.tmp
• %System Root%\Fraps
• %System Root%\Fraps\HELP
• %Start Menu%\Programs\Fraps

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Other System Modifications

This backdoor modifies the following files:

• %Application Data%\GDIPFONTCACHEV1.DAT

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It deletes the following files:

• %Windows%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.916.824593
• %Windows%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.916.824593
• %User Profile%\v2.0.50727.42\security.config.cch.916.824750
• %User Temp%\nsv1.tmp
• %User Temp%\nsk3.tmp

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\System

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

HKEY_CURRENT_USER\Software\DC3_FEXEC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\MediaResources\icm\
VIDC.FPS1

HKEY_LOCAL_MACHINE\SOFTWARE\Fraps

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Fraps

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\System
DisableCMD = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\drivers.desc
frapsvid.dll = "Fraps Video Decompressor"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Drivers32
VIDC.FPS1 = "frapsvid.dll"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\icm\
VIDC.FPS1
Description = "Fraps Video Decompressor"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\icm\
VIDC.FPS1
Driver = "frapsvid.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Fraps
Install_Dir = "%System Root%\Fraps"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fraps
DisplayName = "Fraps"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fraps
UninstallString = "%System Root%\Fraps\uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fraps
NsisSM = "Fraps"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Fraps
NsisInst = "{random values}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
GDIPlus
FontCachePath = "%Application Data%"

(Note: The default value data of the said registry entry is %User Profile%\Local Settings\Application Data.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
MSCONFIG.EXE

Dropping Routine

This backdoor drops the following files:

• %System Root%\CACAO.dll
• %User Temp%\setup.exe
• %System Root%\DEL.BAT
• %User Temp%\nsa2.tmp
• %User Temp%\beepa.bmp
• %User Temp%\nsk3.tmp\AdvSplash.dll
• %User Temp%\nsk3.tmp\StartMenu.dll
• %System Root%\Fraps\fraps.exe
• %System Root%\Fraps\fraps32.dll
• %System Root%\Fraps\fraps64.dll
• %System Root%\Fraps\frapslcd.dll
• %System Root%\Fraps\fraps64.dat
• %System Root%\Fraps\changes.txt
• %System Root%\Fraps\README.HTM
• %System Root%\Fraps\HELP\help_fps.htm
• %System Root%\Fraps\HELP\help_general.htm
• %System Root%\Fraps\HELP\help_movies.htm
• %System Root%\Fraps\HELP\help_screenshots.htm
• %System%\frapsvid.dll
• %User Temp%\nsk3.tmp\System.dll
• %Start Menu%\Programs\Fraps\Uninstall.lnk
• %Start Menu%\Programs\Fraps\Fraps.lnk
• %Desktop%\Fraps.lnk
• %System Root%\Fraps\uninstall.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)

This report is generated via an automated analysis system.