TROJ_VUNDO.SMCP

This Trojan may arrive bundled with malware packages as a malware component.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random characters}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It stays memory-resident by injecting codes into the following processes:

• svchost.exe
• csrss.exe
• lsass.exe

It injects codes into the following process(es):

• firefox.exe
• Maxthon.exe
• iexplore.exe

Autostart Technique

This Trojan drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• {spaces}.lnk

Other System Modifications

This Trojan deletes the following folders:

• %User Profile%\Local Settings\history

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• www.{BLOCKED}te.10dig.net
• {BLOCKED}lmall.8866.org
• {BLOCKED}er.{BLOCKED}ts.org
• {BLOCKED}ns.{BLOCKED}8.net
• {BLOCKED}ercenter.vicp.cc

It saves the files it downloads using the following names:

• %User Profile%\Local Settings\{random characters}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

As of this writing, the said sites are inaccessible.

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

• www.microsoft.com