PTCH_KATUSHA.W
Virus:Win32/Patchload.O (Microsoft), W32/Katusha (McAfee)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
These are legitimate executable files whose code has been altered by another malware to serve as an autostart mechanism for the other malware.
It checks whether the main malware is already running by attempting to open a device object named ACPI#PNP0303#2&da1a3ff&0. Getting the error STATUS_VALIDATE_CONTINUE (0xC0000271) indicates that the main malware is already running.
If the malware is not yet running, it then decrypts the encrypted main malware file %System%\c_{random 5 digit number}.nls and writes the decrypted file to %System%\c_{random 5 digit number}.nl_. The decrypted file is then executed. As a result, the malicious routines of the main malware are exhibited in the affected system.
TECHNICAL DETAILS
NOTES:
These are legitimate executable files whose code has been altered by another malware to serve as an autostart mechanism for the other malware.
It checks whether the main malware is already running by attempting to open a device object named ACPI#PNP0303#2&da1a3ff&0. Getting the error STATUS_VALIDATE_CONTINUE (0xC0000271) indicates that the main malware is already running.
If the malware is not yet running, it then decrypts the encrypted main malware file %System%\c_{random 5 digit number}.nls and writes the decrypted file to %System%\c_{random 5 digit number}.nl_. The decrypted file is then executed. As a result, the malicious routines of the main malware are exhibited in the affected system.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Scan your computer with your Trend Micro product to clean files detected as PTCH_KATUSHA.W. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.