TROJ_BAMTAL.SMIB

This Trojan deletes registry entries, causing some applications and programs to not function properly.

Installation

This Trojan creates the following folders:

• %Application Data%\Windows Server

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This Trojan drops the following files:

• %Application Data%\Windows Server\Windows Server\admin.txt - non-malicious component
• %Application Data%\Windows Server\Windows Server\server.dat - encrypted copy of itself
• %System%\hlp.dat - non-malicious component
• %Temp%\explorer.dat - original copy of explorer.exe
• %Temp%\winlogon.dat - original copy of winlogon.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

Other System Modifications

This Trojan deletes the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = 0

Other Details

This Trojan does the following:

• It modifies the following file(s):
  %System%\winlogon.exe
  %Windows%\explorer.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)