TROJ_AGENT.BBWF

October 12, 2012

ALIASES:

Dropper-FAG!BE84ADCA5C9F (McAfee); PAK:PE_Patch (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Gen:Variant.Kazy.31861 (FSecure)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

TECHNICAL DETAILS

File Size:

137,216 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

03 Apr 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaieSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynbSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyncSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyndSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyneSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyngSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyniSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynjSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynkSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynlSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynmSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynnSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynoSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynpSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynqSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynrSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynsSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsyntSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynuSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynvSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynwSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynxSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynySvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WsynzSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynbSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsyncSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsyndSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsyneSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsyngSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsyniSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynjSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynkSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynlSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynmSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynnSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynoSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\XsynpSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakbSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakcSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakdSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakeSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakgSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakiSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakjSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakkSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaklSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakmSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaknSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakoSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakpSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakqSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakrSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaksSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaktSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakuSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakvSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakwSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakxSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakySvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WakzSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalbSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalcSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaldSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaleSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalgSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaliSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaljSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalkSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WallSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalmSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalnSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaloSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalpSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalqSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalrSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalsSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaltSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaluSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalvSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalwSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalxSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalySvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WalzSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WambSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamcSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamdSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WameSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamiSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamjSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamkSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamlSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WammSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamnSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamoSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WampSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamqSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamrSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamsSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamtSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamuSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamvSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamwSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamxSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamySvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WamzSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanaSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanbSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WancSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WandSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaneSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanfSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WangSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanhSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WaniSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanjSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WankSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanlSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanmSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WannSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanoSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanpSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanqSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanrSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WansSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WantSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanuSvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WanvSvc

Other System Modifications

This Trojan deletes the following files:

%Windows%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.280.38718
%Windows%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.280.38718
%User Profile%\v2.0.50727.42\security.config.cch.280.39359

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
Service1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\lib32wanw

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\lib32wanw\
DEBUG

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WanwSvc
Description = "{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\WanwSvc
FailureActions = "{random values}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
Service1
EventMessageFile = "%Windows%\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application
Sources = "{random characters}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
EventMessageFile = "%System%\ESENT.dll"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryMessageFile = "%System%\ESENT.dll"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryCount = "1"

(Note: The default value data of the said registry entry is 10.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
TypesSupported = "7"

(Note: The default value data of the said registry entry is 7.)

Other Details

This Trojan deletes itself after execution.

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine:

9.200

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaieSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynbSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyncSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyndSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyneSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyngSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyniSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynjSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynkSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynlSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynmSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynnSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynoSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynpSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynqSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynrSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynsSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsyntSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynuSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynvSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynwSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynxSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynySvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WsynzSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynbSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsyncSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsyndSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsyneSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsyngSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsyniSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynjSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynkSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynlSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynmSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynnSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynoSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- XsynpSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakbSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakcSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakdSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakeSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakgSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakiSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakjSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakkSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaklSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakmSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaknSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakoSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakpSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakqSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakrSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaksSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaktSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakuSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakvSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakwSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakxSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakySvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WakzSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalbSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalcSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaldSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaleSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalgSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaliSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaljSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalkSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WallSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalmSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalnSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaloSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalpSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalqSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalrSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalsSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaltSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaluSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalvSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalwSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalxSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalySvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WalzSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WambSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamcSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamdSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WameSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamiSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamjSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamkSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamlSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WammSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamnSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamoSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WampSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamqSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamrSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamsSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamtSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamuSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamvSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamwSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamxSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamySvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WamzSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanaSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanbSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WancSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WandSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaneSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanfSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WangSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanhSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WaniSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanjSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WankSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanlSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanmSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WannSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanoSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanpSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanqSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanrSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WansSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WantSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanuSvc

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- WanvSvc

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application
- Service1

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
- lib32wanw

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\lib32wanw
- DEBUG

To delete the registry key this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services
Still in the left panel, locate and delete the key:
WaieSvc
Again Still in the left panel, locate and delete the key:
WsynaSvc
Again Still in the left panel, locate and delete the key:
WsynbSvc
Again Still in the left panel, locate and delete the key:
WsyncSvc
Again Still in the left panel, locate and delete the key:
WsyndSvc
Again Still in the left panel, locate and delete the key:
WsyneSvc
Again Still in the left panel, locate and delete the key:
WsynfSvc
Again Still in the left panel, locate and delete the key:
WsyngSvc
Again Still in the left panel, locate and delete the key:
WsynhSvc
Again Still in the left panel, locate and delete the key:
WsyniSvc
Again Still in the left panel, locate and delete the key:
WsynjSvc
Again Still in the left panel, locate and delete the key:
WsynkSvc
Again Still in the left panel, locate and delete the key:
WsynlSvc
Again Still in the left panel, locate and delete the key:
WsynmSvc
Again Still in the left panel, locate and delete the key:
WsynnSvc
Again Still in the left panel, locate and delete the key:
WsynoSvc
Again Still in the left panel, locate and delete the key:
WsynpSvc
Again Still in the left panel, locate and delete the key:
WsynqSvc
Again Still in the left panel, locate and delete the key:
WsynrSvc
Again Still in the left panel, locate and delete the key:
WsynsSvc
Again Still in the left panel, locate and delete the key:
WsyntSvc
Again Still in the left panel, locate and delete the key:
WsynuSvc
Again Still in the left panel, locate and delete the key:
WsynvSvc
Again Still in the left panel, locate and delete the key:
WsynwSvc
Again Still in the left panel, locate and delete the key:
WsynxSvc
Again Still in the left panel, locate and delete the key:
WsynySvc
Again Still in the left panel, locate and delete the key:
WsynzSvc
Again Still in the left panel, locate and delete the key:
XsynaSvc
Again Still in the left panel, locate and delete the key:
XsynbSvc
Again Still in the left panel, locate and delete the key:
XsyncSvc
Again Still in the left panel, locate and delete the key:
XsyndSvc
Again Still in the left panel, locate and delete the key:
XsyneSvc
Again Still in the left panel, locate and delete the key:
XsynfSvc
Again Still in the left panel, locate and delete the key:
XsyngSvc
Again Still in the left panel, locate and delete the key:
XsynhSvc
Again Still in the left panel, locate and delete the key:
XsyniSvc
Again Still in the left panel, locate and delete the key:
XsynjSvc
Again Still in the left panel, locate and delete the key:
XsynkSvc
Again Still in the left panel, locate and delete the key:
XsynlSvc
Again Still in the left panel, locate and delete the key:
XsynmSvc
Again Still in the left panel, locate and delete the key:
XsynnSvc
Again Still in the left panel, locate and delete the key:
XsynoSvc
Again Still in the left panel, locate and delete the key:
XsynpSvc
Again Still in the left panel, locate and delete the key:
WakaSvc
Again Still in the left panel, locate and delete the key:
WakbSvc
Again Still in the left panel, locate and delete the key:
WakcSvc
Again Still in the left panel, locate and delete the key:
WakdSvc
Again Still in the left panel, locate and delete the key:
WakeSvc
Again Still in the left panel, locate and delete the key:
WakfSvc
Again Still in the left panel, locate and delete the key:
WakgSvc
Again Still in the left panel, locate and delete the key:
WakhSvc
Again Still in the left panel, locate and delete the key:
WakiSvc
Again Still in the left panel, locate and delete the key:
WakjSvc
Again Still in the left panel, locate and delete the key:
WakkSvc
Again Still in the left panel, locate and delete the key:
WaklSvc
Again Still in the left panel, locate and delete the key:
WakmSvc
Again Still in the left panel, locate and delete the key:
WaknSvc
Again Still in the left panel, locate and delete the key:
WakoSvc
Again Still in the left panel, locate and delete the key:
WakpSvc
Again Still in the left panel, locate and delete the key:
WakqSvc
Again Still in the left panel, locate and delete the key:
WakrSvc
Again Still in the left panel, locate and delete the key:
WaksSvc
Again Still in the left panel, locate and delete the key:
WaktSvc
Again Still in the left panel, locate and delete the key:
WakuSvc
Again Still in the left panel, locate and delete the key:
WakvSvc
Again Still in the left panel, locate and delete the key:
WakwSvc
Again Still in the left panel, locate and delete the key:
WakxSvc
Again Still in the left panel, locate and delete the key:
WakySvc
Again Still in the left panel, locate and delete the key:
WakzSvc
Again Still in the left panel, locate and delete the key:
WalaSvc
Again Still in the left panel, locate and delete the key:
WalbSvc
Again Still in the left panel, locate and delete the key:
WalcSvc
Again Still in the left panel, locate and delete the key:
WaldSvc
Again Still in the left panel, locate and delete the key:
WaleSvc
Again Still in the left panel, locate and delete the key:
WalfSvc
Again Still in the left panel, locate and delete the key:
WalgSvc
Again Still in the left panel, locate and delete the key:
WalhSvc
Again Still in the left panel, locate and delete the key:
WaliSvc
Again Still in the left panel, locate and delete the key:
WaljSvc
Again Still in the left panel, locate and delete the key:
WalkSvc
Again Still in the left panel, locate and delete the key:
WallSvc
Again Still in the left panel, locate and delete the key:
WalmSvc
Again Still in the left panel, locate and delete the key:
WalnSvc
Again Still in the left panel, locate and delete the key:
WaloSvc
Again Still in the left panel, locate and delete the key:
WalpSvc
Again Still in the left panel, locate and delete the key:
WalqSvc
Again Still in the left panel, locate and delete the key:
WalrSvc
Again Still in the left panel, locate and delete the key:
WalsSvc
Again Still in the left panel, locate and delete the key:
WaltSvc
Again Still in the left panel, locate and delete the key:
WaluSvc
Again Still in the left panel, locate and delete the key:
WalvSvc
Again Still in the left panel, locate and delete the key:
WalwSvc
Again Still in the left panel, locate and delete the key:
WalxSvc
Again Still in the left panel, locate and delete the key:
WalySvc
Again Still in the left panel, locate and delete the key:
WalzSvc
Again Still in the left panel, locate and delete the key:
WamaSvc
Again Still in the left panel, locate and delete the key:
WambSvc
Again Still in the left panel, locate and delete the key:
WamcSvc
Again Still in the left panel, locate and delete the key:
WamdSvc
Again Still in the left panel, locate and delete the key:
WameSvc
Again Still in the left panel, locate and delete the key:
WamfSvc
Again Still in the left panel, locate and delete the key:
WamhSvc
Again Still in the left panel, locate and delete the key:
WamiSvc
Again Still in the left panel, locate and delete the key:
WamjSvc
Again Still in the left panel, locate and delete the key:
WamkSvc
Again Still in the left panel, locate and delete the key:
WamlSvc
Again Still in the left panel, locate and delete the key:
WammSvc
Again Still in the left panel, locate and delete the key:
WamnSvc
Again Still in the left panel, locate and delete the key:
WamoSvc
Again Still in the left panel, locate and delete the key:
WampSvc
Again Still in the left panel, locate and delete the key:
WamqSvc
Again Still in the left panel, locate and delete the key:
WamrSvc
Again Still in the left panel, locate and delete the key:
WamsSvc
Again Still in the left panel, locate and delete the key:
WamtSvc
Again Still in the left panel, locate and delete the key:
WamuSvc
Again Still in the left panel, locate and delete the key:
WamvSvc
Again Still in the left panel, locate and delete the key:
WamwSvc
Again Still in the left panel, locate and delete the key:
WamxSvc
Again Still in the left panel, locate and delete the key:
WamySvc
Again Still in the left panel, locate and delete the key:
WamzSvc
Again Still in the left panel, locate and delete the key:
WanaSvc
Again Still in the left panel, locate and delete the key:
WanbSvc
Again Still in the left panel, locate and delete the key:
WancSvc
Again Still in the left panel, locate and delete the key:
WandSvc
Again Still in the left panel, locate and delete the key:
WaneSvc
Again Still in the left panel, locate and delete the key:
WanfSvc
Again Still in the left panel, locate and delete the key:
WangSvc
Again Still in the left panel, locate and delete the key:
WanhSvc
Again Still in the left panel, locate and delete the key:
WaniSvc
Again Still in the left panel, locate and delete the key:
WanjSvc
Again Still in the left panel, locate and delete the key:
WankSvc
Again Still in the left panel, locate and delete the key:
WanlSvc
Again Still in the left panel, locate and delete the key:
WanmSvc
Again Still in the left panel, locate and delete the key:
WannSvc
Again Still in the left panel, locate and delete the key:
WanoSvc
Again Still in the left panel, locate and delete the key:
WanpSvc
Again Still in the left panel, locate and delete the key:
WanqSvc
Again Still in the left panel, locate and delete the key:
WanrSvc
Again Still in the left panel, locate and delete the key:
WansSvc
Again Still in the left panel, locate and delete the key:
WantSvc
Again Still in the left panel, locate and delete the key:
WanuSvc
Again Still in the left panel, locate and delete the key:
WanvSvc
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application
Still in the left panel, locate and delete the key:
Service1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>ESENT>Process
Still in the left panel, locate and delete the key:
lib32wanw
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>ESENT>Process>lib32wanw
Still in the left panel, locate and delete the key:
DEBUG
Close Registry Editor.

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WanwSvc
- Description = "{random characters}"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WanwSvc
- FailureActions = "{random values}"

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Service1
- EventMessageFile = "%Windows%\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"

Step 5

Restore this modified registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application
- From: Sources = "{random characters}"
  To: Sources = ""{random values}""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: EventMessageFile = "%System%\ESENT.dll"
  To: EventMessageFile = ""{random values}""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryMessageFile = "%System%\ESENT.dll"
  To: CategoryMessageFile = ""{random values}""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: CategoryCount = "1"
  To: CategoryCount = ""10""

In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
- From: TypesSupported = "7"
  To: TypesSupported = ""7""

Step 6

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_AGENT.BBWF. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 7

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%Windows%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.280.38718
%Windows%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.280.38718
%User Profile%\v2.0.50727.42\security.config.cch.280.39359

Did this description help? Tell us how we did.

TROJ_AGENT.BBWF

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

TROJ_AGENT.BBWF

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific