TROJ_DROPPER.YRK
Trojan.ADH (Symantec); TrojanDropper:Win32/Dunik!rts (Microsoft); Trojan-Dropper.Win32.Agent.dcsk (Kaspersky); Mal/Generic-L (Sophos)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes registry entries, causing some applications and programs to not function properly.
It does not have any propagation routine.
It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
It does not have any downloading capability.
It does not have any information-stealing capability.
TECHNICAL DETAILS
1,167,360 bytes
EXE
Yes
13 Sep 2011
Terminates processes
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following files:
- %Current%\setup.exe - detected by Trend Micro as BKDR_DUNIK.AA
- %User Temp%\INTERACT2010.pdf - non-malicious file
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
Other System Modifications
This Trojan deletes the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\PowerPoint\
Resiliency
DisabledItems =
HKEY_CURRENT_USER\Software\Microsoft\
Office\11.0\PowerPoint\
Resiliency
StartupItems =
Propagation
This Trojan does not have any propagation routine.
Process Termination
This Trojan terminates the following processes if found running in the affected system's memory:
- Acrobat.exe
- AcroRd32.exe
Dropping Routine
This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
Download Routine
This Trojan does not have any downloading capability.
Information Theft
This Trojan does not have any information-stealing capability.
NOTES:
It opens the non-malicious PDF file to hide its execution.
It does not exploit any vulnerability.
SOLUTION
9.200
8.424.03
13 Sep 2011
8.425.00
14 Sep 2011
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 3
Identify and terminate files detected as TROJ_DROPPER.YRK
- If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
- If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.
Step 4
Search and delete this file
- %User Temp%\INTERACT2010.pdf
Step 5
Scan your computer with your Trend Micro product to delete files detected as TROJ_DROPPER.YRK . If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 6
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
NOTES:
RECOMMENDATIONS
1. This malware is detected and removed by the latest Trend Micro anti-malware engine and pattern. Always keep pattern files and engines up-to-date. To know more about updating your Trend Micro product’s pattern, please refer to the following Trend Micro support page:- http://esupport.trendmicro.com/9/How-do-I-manually-update-the-virus-pattern-of-my-Trend-Micro-Internet.aspx
Note: The steps apply for specific products indicated in the page.
2. To actively detect and protect your machine, enable real-time scanning of your Trend Micro anti-malware product. Refer to the following Trend Micro support page to know more about enabling real-time scanning in your Trend Micro product:
- Home Users: http://esupport.trendmicro.com/solution/en-us/1054798.aspx
- Business Users: http://esupport.trendmicro.com/Pages/How-do-I-enable-or-disable-the-Real-time-Protection-of-Trend-M-EN-1038331.aspx
3. For shared computers that are connected to a network, ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task.
4. Enable firewall to protect against threats. http://esupport.trendmicro.com/3/How-do-I-enable-or-disable-the-Personal-Firewall-of-Trend-Micr-EN-1038273.aspx
5. Enforce a strong password policy. Typically, a strong password consists of a mix of numbers, letters, and characters.
6. Keep software and operating systems updated with latest patches released by vendors to address vulnerabilities and exploits.
7. Block unused ports to disallow malware from using these ports to communicate and/or enforce commands.
8. Be aware of social engineering attacks.
9. Use safe coding practices to avoid exploit of websites and applications.
10. Avoid accessing the listed malicious URLs to prevent possible re-infection.
11. Monitor network connections for any suspicious connection or connectivity.
12. Regularly update list of sites that are trusted.
13. Turn off file sharing if not needed. If needed, disable anonymous access to shared folders.
14. Avoid downloading software cracks and/or pirated applications.
15. Clear browser cache and delete cookies regularly.
16. Delete files in the %User Temp% folder.
Did this description help? Tell us how we did.