BKDR_POISON.AKO
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Backdoor
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
This backdoor does not have any file infection routine.
It does not have any propagation routine.
It opens a hidden Internet Explorer window. It connects to a website to send and receive information.
It does not have any downloading capability.
TECHNICAL DETAILS
Arrival Details
This backdoor may be downloaded from the following remote sites:
- http://{BLOCKED}pdate.org/antivirus/antivirusupdate.exe
Infection Points
This backdoor does not have any file infection routine.
Installation
This backdoor drops the following file(s)/component(s):
- %User Temp%\xz.exe - detected as the same malware
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
It drops the following non-malicious files:
- %Windows%\java\classes\JQB.dll
- %User Temp%\msvc000001a.txt
- %Program Files%\Common Files\ODBC\ODBC.dll
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.)
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- 7-05'rat
Autostart Technique
This backdoor adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{73B2075B-2925-3CDD-64CE-309B5AEB42F2}
StubPath = "%System%:secrm.scr"
Other System Modifications
This backdoor adds the following registry keys as part of its installation routine:
HKEY_CURRENT_USER\Software\WinRAR SFX
Propagation
This backdoor does not have any propagation routine.
Backdoor Routine
This backdoor opens a hidden Internet Explorer window.
It connects to the following websites to send and receive information:
- http://{BLOCKED}9.{BLOCKED}eliver.com
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- {BLOCKED}rus-groups.com
Download Routine
This backdoor does not have any downloading capability.
NOTES:
It arrives as an attachment to email messages spammed by other malware/grayware or malicious users as antivirusupdate.exe.
It creates an Alternate Data Stream (ADS) copy of itself:
- %System%:secrm.scr
This allows the malware to hide itself from detection. It also allows it to execute whenever the System Folder is accessed.
This malware attempts to connect to remote site to send and receive information/commands. The routines to perform may vary depending on the remote user’s commands. Through a command, it may be able to steal information such as keystrokes.
This malware does not have rootkit capabilities.
This malware does not exploit any vulnerability.
SOLUTION
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Using Trend Micro Rootkit Buster
RootkitBuster is a rootkit scanner that can check through hidden files, registry entries, processes, drivers, and hooked system services.
To use this tool, do the following:
- Download the tool from the following link and extract it to a temporary folder:
https://www.trendmicro.com/download/rbuster.asp - Run the RootkitBuster.exe file.
- On the upper left corner, select the types of hidden items that you wish to scan. We recommend selecting all types.
- Click the Scan button.
- The system is infected by this malware if the Scan result is similar to the image below:
Step 3
Restart in Safe Mode
Step 4
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.
- In HKEY_CURRENT_USER\Software
- WinRAR SFX
- WinRAR SFX
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
- {73B2075B-2925-3CDD-64CE-309B5AEB42F2}
- {73B2075B-2925-3CDD-64CE-309B5AEB42F2}
Step 5
Search and delete this file
- %Windows%\java\classes\JQB.dll
- %User Temp%\msvc000001a.txt
- %Program Files%\Common Files\ODBC\ODBC.dll
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_POISON.AKO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.