TROJ_SAVIT.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following component file(s):

• %Application Data%\msvcr.dll
• %Application Data%\ws2help.PNF

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following non-malicious files:

• %System%\ipsecstap.dat
• %System%\{numbers}

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following copies of itself into the affected system:

• %Application Data%\IECheck.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This Trojan modifies the following file(s):

• %System%\netsat.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Other Details

This Trojan connects to the following website to send and receive information:

• 4.{BLOCKED}st.{BLOCKED}22.org.cn
• 3.{BLOCKED}st.{BLOCKED}22.org.cn
• 2.{BLOCKED}st.{BLOCKED}22.org.cn
• 1.{BLOCKED}st.{BLOCKED}22.org.cn
• {BLOCKED}st.{BLOCKED}22.org.cn

NOTES:

It searches for legitimate shortcut (LNK) files in the %User Startup% folder. It then modifies one of the LNK files it finds to automatically execute its dropped copy every time the infected shortcut file is run.