TROJ_VILSEL.JM

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %Windows%\SoftwareDistribution
• %Windows%\SoftwareDistribution\DataStore\Logs\
• %Windows%\SoftwareDistribution\DataStore

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other System Modifications

This Trojan deletes the following files:

• %Windows%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{3B20B0AB-1ABF-438E-AD44-71162A3BC5FD}.crmlog
• %Windows%\SoftwareDistribution\DataStore\Logs\edbtmp.log

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
LogSessionName = "stdout"

(Note: The default value data of the said registry entry is stdout.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
Active = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi
ControlFlags = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi\ImapiSvc
Guid = "8107d8e9-e323-49f5-bba2-abc35c243dca"

(Note: The default value data of the said registry entry is 8107d8e9-e323-49f5-bba2-abc35c243dca.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Tracing\
Microsoft\Imapi\ImapiSvc
BitNames = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

(Note: The default value data of the said registry entry is ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\dmio\Encapsulation Info

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\dmload\EncapsulationPending

Dropping Routine

This Trojan drops the following files:

• %System%\cisvc.vir
• %System%\clipsrv.vir
• %System%\dllhost.vir
• %System%\dmadmin.vir
• %System%\imapi.vir
• %System%\msiexec.vir
• %System%\locator.vir
• %System%\rsvp.vir
• %System%\smlogsvc.vir
• %System%\tlntsvr.vir
• %System%\wbem\wmiapsrv.vir
• %System%\magnify.vir
• %System%\narrator.vir
• %System%\osk.vir
• %System%\utilman.vir
• %Program Files%\Outlook Express\wab.vir
• %System%\cmd.vir
• %Program Files%\Windows Media Player\wmplayer.vir
• %System%\notepad.vir
• %System%\mobsync.vir
• %System%\tourstart.vir
• %Program Files%\Outlook Express\msimn.vir
• %System%\rcimlby.vir
• %System%\mnmsrvc.vir
• %Windows%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{D18EAE61-5F69-442E-9067-DE4ACF8AE006}.crmlog
• %System%\msdtc.vir
• %System%\netdde.vir
• %System%\sessmgr.vir
• %Program Files%\winpcap\rpcapd.vir
• %System%\scardsvr.vir
• %System%\vssvc.vir
• %System%\accwiz.vir
• %System%\calc.vir
• %System%\mstsc.vir
• %System%\sndrec32.vir
• %System%\sndvol32.vir
• %System%\mspaint.vir
• %System%\ntbackup.vir
• %System%\charmap.vir
• %System%\cleanmgr.vir
• %System%\usmt\migwiz.vir
• %Program Files%\Common Files\Microsoft Shared\MSInfo\msinfo32.vir
• %System%\Restore\rstrui.vir
• %Program Files%\Windows NT\Accessories\wordpad.vir
• %System%\odbcad32.vir
• %System%\freecell.vir
• %System%\mshearts.vir
• %System%\winmine.vir
• %Program Files%\Windows NT\Pinball\PINBALL.vir
• %System%\sol.vir
• %System%\spider.vir
• %Program Files%\MSN\MSNCoreFiles\Install\msnsusii.vir
• %Program Files%\Movie Maker\moviemk.vir
• %System%\wupdmgr.vir
• %Desktop%\vcredist_x86.vir
• %System%\cisvc.exe
• %System%\clipsrv.exe
• %System%\dllhost.exe
• %System%\dmadmin.exe
• %System%\imapi.exe
• %System%\msiexec.exe
• %System%\locator.exe
• %System%\rsvp.exe
• %System%\smlogsvc.exe
• %System%\tlntsvr.exe
• %System%\wbem\wmiapsrv.exe
• %System%\magnify.exe
• %System%\narrator.exe
• %System%\osk.exe
• %System%\utilman.exe
• %Program Files%\Outlook Express\wab.exe
• %System%\cmd.exe
• %Program Files%\Windows Media Player\wmplayer.exe
• %System%\notepad.exe
• %System%\mobsync.exe
• %System%\tourstart.exe
• %Program Files%\Outlook Express\msimn.exe
• %System%\rcimlby.exe
• %System%\mnmsrvc.exe
• %System%\msdtc.exe
• %System%\netdde.exe
• %System%\sessmgr.exe
• %Program Files%\winpcap\rpcapd.exe
• %System%\scardsvr.exe
• %System%\vssvc.exe
• %System%\accwiz.exe
• %System%\calc.exe
• %System%\mstsc.exe
• %System%\sndrec32.exe
• %System%\sndvol32.exe
• %System%\mspaint.exe
• %System%\ntbackup.exe
• %System%\charmap.exe
• %System%\cleanmgr.exe
• %System%\usmt\migwiz.exe
• %Program Files%\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
• %System%\Restore\rstrui.exe
• %Program Files%\Windows NT\Accessories\wordpad.exe
• %System%\odbcad32.exe
• %System%\freecell.exe
• %System%\mshearts.exe
• %System%\winmine.exe
• %Program Files%\Windows NT\Pinball\PINBALL.EXE
• %System%\sol.exe
• %System%\spider.exe
• %Program Files%\MSN\MSNCoreFiles\Install\msnsusii.exe
• %Program Files%\Movie Maker\moviemk.exe
• %System%\wupdmgr.exe
• %Desktop%\vcredist_x86.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)

This report is generated via an automated analysis system.