Content
Havedo
- Type
- Trojan
- SubType
- Discovery Date
- 05/12/2005
- Length
- Minimum DAT
- 4490 (05/12/2005)
- Updated DAT
- 4490 (05/12/2005)
- Minimum Engine
- 5.1.00
- Description Added
- 05/12/2005
- Description Modified
- 05/31/2005 9:26 PM (PT)
Tab Navigation
Characteristics
Trojan Havedo attempts to corrupt %sysdir%\cmd.exe by replacing the original file with a fake command window. If successful the new "cmd.exe" will just open up the shell but no commands will work. A search for Visual Foxpro 6.0 is also made, if found the trojan attempts to execute the file.
The Trojan copies itself with the name cmd.lnd in %windir%. It changes the default folder options in order to hide the files. Some variants of this trojan will not work correctly on Windows XP and crash upon execution, however it works in Win 2000.
Registry Changes
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{37125E31-AD55-4F7B-BF6F-A17A20953945}\InprocServer32\: "%windir%\iexplorex.dll" - HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iexplorex.IEHelper
\CLSID\: "{37125E31-AD55-4F7B-BF6F-A17A20953945}" - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\
CheckedValue: 0x00000000 - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\havedo\
onetimeday :0x1a
Files Added (in %windir)
- cmd.lnd
(557,056 bytes)
MD5: E5 EB 72 34 9D A1 6E 3E 0D 36 78 C8 43 9B D0 1B - iexplorex.dll
(451,072 bytes)
MD5: 1F 07 A7 DA 0C A4 9D C6 8B 6F 1C 0D 9D 5D FB A4
Symptoms
- Presence of the files/filesizes and registry keys as mentioned above
- Auto execution of Visual Foxpro 6.0
Method of Infection
Manual execution of the binary starts the infection, there's no exploit associated with this file.
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Characteristics
Characteristics -
Trojan Havedo attempts to corrupt %sysdir%\cmd.exe by replacing the original file with a fake command window. If successful the new "cmd.exe" will just open up the shell but no commands will work. A search for Visual Foxpro 6.0 is also made, if found the trojan attempts to execute the file.
The Trojan copies itself with the name cmd.lnd in %windir%. It changes the default folder options in order to hide the files. Some variants of this trojan will not work correctly on Windows XP and crash upon execution, however it works in Win 2000.
Registry Changes
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{37125E31-AD55-4F7B-BF6F-A17A20953945}\InprocServer32\: "%windir%\iexplorex.dll" - HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iexplorex.IEHelper
\CLSID\: "{37125E31-AD55-4F7B-BF6F-A17A20953945}" - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\
CheckedValue: 0x00000000 - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\havedo\
onetimeday :0x1a
Files Added (in %windir)
- cmd.lnd
(557,056 bytes)
MD5: E5 EB 72 34 9D A1 6E 3E 0D 36 78 C8 43 9B D0 1B - iexplorex.dll
(451,072 bytes)
MD5: 1F 07 A7 DA 0C A4 9D C6 8B 6F 1C 0D 9D 5D FB A4
Symptoms
Symptoms -
- Presence of the files/filesizes and registry keys as mentioned above
- Auto execution of Visual Foxpro 6.0
Method of Infection
Method of Infection -
Manual execution of the binary starts the infection, there's no exploit associated with this file.
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
