TROJ_FRAUDPAC.QL

This Trojan has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware from remote sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be downloaded by the following malware/grayware from remote sites:

• TROJ_PIDIEF.AAL

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\imagehlpj.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects itself into the following processes running in the affected system's memory:

• SVCHOST.EXE

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ShellHWDetectionVMTools
Type = "110"
Start = "2"
ErrorControl = "0"
ImagePath = "%System%\imagehlpj.exe srv"
DisplayName = "Shell Hardware Detection ShellHWDetectionVMTools"
ObjectName = "LocalSystem"

Download Routine

As of this writing, the said sites are inaccessible.

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}ide.net/v44/index.php
• http://{BLOCKED}.net/v44/index.php
• http://{BLOCKED}o.com/v44/index.php