TSPY_ONLINEG.NRR

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This spyware modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "ws2help.dll"

(Note: The default value data of the said registry entry is "".)

Dropping Routine

This spyware drops the following files:

• %Windows%\IRIMGV3.bmp - detected as TSPY_ONLINEG.SM3

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This spyware deletes itself after execution.

NOTES:

It renames the file legitimate %System%\ws2help.dll to %System%\ws2helpxp.dll then drops its component file as %System%\ws2help.dll.

Since the malware component TSPY_ONLINEG.SM3 replaces the legitimate file, the autostart of the replaced file is used by the malware as its own. As a result, malicious behavior of this malware component is executed on the system.