McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Bancos.LU (Panda)

Characteristics

• The worm configures itself to load at startup. 

DNS Queries

• nordbbs.com  

• dscteam.com

Accessed URLs are monitored for the inclusion of particular strings.  If the strings exist, the client is redirected to a 'dummy' site, which is intended to mimic a legitimate banking site.  The strings include:

212.58.14.196
217.193.172.38
440strand.com
53.com
abaflex.com
abnamro.com
accesd.desjardins.com
account3000.com
accounts.key.com
accu.com.au
acmfunds.com
agf.com
alaskausa.org
aldenstate.net
allianceach.com
alpha.gr
anbusiness.com
angloconnect.com
anz.com.au
asp2.paybillag.com
auth4.jpmorgan.com
authzone.virtualbank.com
ba-ca.com
banca.cajaen.es
bancae.caixapenedes.com
bancopostaonline.poste.it
banesnet.banesto.es
banking.1822direkt.com
banking.firsttennessee.*
banking.ing-diba.de
banking.lbbw.de
banking.postbank.de
banking.raiffeisen.at
banking.seb.de
banking.uboc.com
bankingportal.naspa.de
bankofscotlandhalifax-online.co.uk
bankone.com
barclaygrp.com
barrington-bank.com
bbh.com
bbk.es
bbvanet.com
bbvanetoffice.com
bdc.ca
bdi.com.do
be.bancofar.es
bgk24biznes.pl
bise.pl
bmo.com
bnc.ca
bnpparibas.net
boi-bol.com
bosbank24.pl
bpd.com.do
bph.pl
bpr.it
bresa.com.pl
brokerage.comdirect.de
brokerage.lbbw.de
brownshipley.com
bsa.ad
bsgllc.net/cgi-bin
bsk.com.pl
businessnet.ba-ca.com
bznet.bancozaragozano.es
cahoot.com
caixasabadell.net
calvados2-enligne.credit-agricole.fr
capfed.com
carenet.fnfismd.com
carnet.cajarioja.es
cbcbank.com/olb
cbtfl.com
ccblv.net
cdg.citibank.de
centralbankus.com/secure
centrum24.pl
centurynational2.com
chaseonline.chase.com
cib.ibanking-services.com
cib.ibanking-services.com
cibc.com
cilme.it
citibusinessonline.da-us.citibank.com
citizensbank.ca
cnbsec1.cnbank
coma.comdirect.de
combnk.com
comerica.com
co-operativebank.co.uk
coral.co.uk
cortalconsors.de
csbnet.com
csccu.com
cunet.org
daiwasmbc.co.uk
dexia.sk
drussl.com
dscteam.com
dzbank.pl
ebancoval.bancoval.es
ebank.hsbc.co.uk
ebank.pinnbank.com
ec31.arl-tsg.com/svb-rtl/
ecorpla1.com/EBC_EBC1961
e-credit.ad
emigrant.com
emocorp.com
enlaza.cajadeburgos.es
enterprise1.openbank.com
esube.oyakbank.com.tr
etimebanker.bankofthewest.com
etimebanker.bankofthewest.com
etimebanker.bankofthewest.com
extranet.banesto.es
ezcardinfo.com
fairbairnpb.com
faithstouch.org
fbb.gr
ffsb.com
fiibg.com
fineco.it
firstib.com
firstpointe.com
flagship*.vanguard.com
flushingsavings.com
founders.com
gb24.pl
genfed.com
gironet.com
global1.onlinebank.com
global1.onlinebank.com
greencentury.com
gsjbwere.com
hampshire-trust.co.uk
heritagebankfl.com
hoaresbank.co.uk
hp.first-direct.com
hvbrsce.com
hwcm.com
ib.cbonline.co.uk
ib.nbonline.co.uk
ib.sfbank.co.uk
ibanc.bowc.com
ibank.barclays.co.uk
ibank.barclays.co.uk
ibank.cahoot.com
ibank.internationalbanking.barclays.com
ibre.com.pl
ing-diba.de
integrum.pl
interconnexio2.bibm.ad
internet724.vakifbank.com.tr
investing.schwab.com
investors.com
irnb.com
isube.disbank.com.tr
iurisbank.com
jbpb.com
kb24.pl
laiki.com
lbbwebclient.lehmanbank.com
mandtbank.com
meine.deutsche-bank.de
miamsales.com
militarybankonline.bankofamerica.com
millenet.pl
montevia.elmonte.es
mvelopes.com
my.if.com
my.if.com
myaccounts.navyfcu.org
mybank.alliance-leicester.co.uk
national.com.au
nationet.com
netbank.commbank.com
newton.co.uk
novaweb.gr
nvsl.com
nwolb.com
ohnward.com
oi.cajamadrid.es
oie.cajamadridempresas.es
olb2.nationet.com
online*.lloydstsb.*
online.ba-ca.com
online.sainsburysbank.co.uk
online.wellsfargo.com
onlinebanking.bankofoklahoma.com
onlinebanking-nw.bankofamerica.com
onlineid.bankofamerica.com
openplan.co.uk
orcobank.com
osufederal.com
pastornetempresas.bancopastor.es
pastornetparticulares.bancopastor.es
payentry.com
paypal.com
pcb.peoples.com
pcb.peoples.com
pcbank.sbdanbury.com
pcbanking.umb.com
pccaja.lacajadecanarias.es
pekao24.pl
peoples.com
peoples-state-bank.com
pictet.com
planters-bank.com
portal*.commerzbanking.de
postbank.de
poste.it
privati.intesabci.it
propay.com
r-bank.pl
retail.ncbelink.com
royalbank.com
sainsburysbank.co.uk
samba.com
schwab.com
scnb.com
seb.de
secure.griffonbank.com
secure.hnbfl.com
secure.ingdirect.co.uk
secure.mvnt4.com/tcf
secure.thebancorp.com
secure1.afba.com
secure-fcbflorida.com
sghambros.com
smile.
sso.uboc.com
standardlife.com
stgeorge.com.au
suncorpmetway.com.au
suntrust.com/portal
tcfexpressbusiness.com
tctrustco.com
tdwaterhouse.com
teleweb.com.tr
ticari.teleweb.com.tr
tpars.com
trust.firsttennessee.com
trustdirect.umb.com
trustweb.com
uboc.com
ubt.com
united-bk.com
uno-e.com
us.etrade.com
usb.com.cy
vcb.com
vr-ebanking.de
vub.sk
wallstreet-corp.co.ae
wc.floridacitizensbank
web.da-us.citibank.com
web.harborbank.com/hol
webbank.openplan.co.uk
web-banker.com/frostproof
webbanking.comerica.com
webid.gs.com
welcome*.co-operativebank.co.uk
welcome*.smile.co.uk
westlb.com
westpac.com.au
wnu.com
ww2.homebanking-*.de
www*.bancopopular.es
www*.fiibg.com
www.365online.com
www.ardil.bancogallego.es
www.arquia.es
www.bancamediolanum.it
www.banking.co.at
www.bankone.com
www.bv-i.bancodevalencia.es
www.caixalaietana.es
www.cajabadajoz.es
www.cajacanarias.es
www.cajavital.es
www.ccm.es
www.clavenet.net
www.dresdner-privat.de
www.ebank.us.hsbc.com
www.exactpay.com
www.firstib.com
www.halifax-online.co.uk
www.iblogin.com
www.jpmorganinvest.com
www.netxselect.com
www.nwolb.com
www.onlinesefcu.com
www.rbsdigital.com
www.selectbenefit.com
www.sella.it
www.sharebuilder.com
www.unicaja.es
www.virtualcu.net
www1.ibercajadirecto.com
www2.citizensbankonline.com
www2.site-secure.com
wwws.ameritrade.com
wwws.fibanc.es
wwws.sanostra.es
ykb.teleweb.com.tr

The worm also contains a keylogging component, which triggers when the user enters specific strings.  These strings include:

.ml.com
12move
1822direkt
1stfed
1stnatbank
1stnationalbank
1stpacbank
21cn
2by2
2die4
3web
aaahawk
aacfcu
abank
abbey
accesscomm
accountnumber
acninc
adams
addcom
adelphia
afbca
affinitybank
airtel
akbank
alabamacu
alaska
alaweb
albanybankandtrust2
albarakaturk
alliance-leicester
alliedcu
alltel
aloha
alpinebank
altapdonline
altavista
alum
americafirst
americanbusinessbank
americanriverbank
ameritech
amsouth
anbank
anbbank
another
ansbacher
antisocial
aodelink
appliedcardbank
AQResp
arcor
arkansas
arquia
arrakis
artisansbank
artlover
arvest
asahi-net
ashevillesavings2
asianavenue
astound
asyafinans
atlantic
attbi
auburn
aufcu
austarnet
austin
avantel
awesomenet
awfumc
banca
bancacrv
bancadelpiemonte
bancaintesa
bancaja
bancalombarda
bancamarch
bancaroma
bancasassari
banco
bancodevalencia
bancodisicilia
bancoetcheverria
bancofar
bancogallego
bancomadrid
bancomercantil
bancopastor
bancopopular
bancosardegna
bancourquijo
bancoval
bancozaragozano
banesto
banif
bankccb
bankcolonial
bankhapoalim
bankhiawassee
banking
bankjerusalem
bankleumi
bankoa
bankofalameda
bankofamerica
bankofantigua
bankofbermuda
bankofcyprus
bankofdelmarvahb
bankofdudley
bankofny
bankofoklahoma
bankofstockton
bankoftampa
bankofthewest
bankofutica
bankonsuperiorsavings
bankorient
bankwest
barclays
beaconfederal
beer
belgacom
bellsouth
bendcable
bendigobank
beneficial
bessemer
bestweb
bham
bidpay
bigfoot
bigpond
bikerider
billpaysite
bipop
bizcurrency
blackvoices
blilk
blueflamecu
bluewin
blueyonder
bolt
borel
boxfrog
bpavirtual
bpcbank
bpdbank
bper
bpmat
breathe
bredband
brentwoodbank
bresnan
bright
britanniainternational
broadpark
broadwayfed
broker
btclick
btconnect
budweiser
businessmanager
butterfield
bzwbk24
cableaz
cableinet
cablelynx
cableone
cablespeed
caixa
caixacatalunya
caixagalicia
caixaguissona
caixalaietana
caixamanlleu
caixaontinyent
caixapenedes
caixasabadell
caixatarragona
caja
cajacanarias
cajadeavila
cajadeburgos
cajaduero
cajaen
cajaespana
caja-granada
cajalaboral
cajalon
cajamadrid
cajamurcia
cajarioja
cajasegovia
cajastur
cajasur
cajavital
canada
cantv
canyonnational
capital
cardmemberservices
caribe
carispaq
carolina
carverbank
cassarimini
catlover
cayugalakenationalbank
cbbank
ccbill
ccbusa
celebrityx
centurybank
centurytel
champlainbank
chariot
charter
chase
cheerful
chello
chemicalbankmi
chemungwebach
chemungwebcorp
chinocommercialbank
chorus
chronopay
cinci
cisco
citibusiness
citicorp
citizensbanknc
citlink
citycu
citynet
cityntl
citywidebanks
clara
classicnet
clavenet
clemson
cliffhanger
clix
cmbank
cnbbartow
coastalnet
coastbankflorida
cobizbank
cogeco
collegeclub
colonialbk
colonya
colorado
columbia
columbus
comcast
comerica
comic
compaq
compassweb
comporium
compuserve
concentric
consultant
copper
coqui
core
cornell
countrybank
countybank
covad
crbna
creditunion
creval
crosslink
crownbank
csbankny
ctbatlantahb
cue-commerce
cukehb2
cuna
cunetbranch
cusa-hfs
cutey
cwnet
cyber
cypress-bank
darbybank
datacomm
da-us
dcbank
debitel
dejazzd
dellepro
denalifcu
deutsche-bank
dgmbank
dial
digitalbancorpbank
dircon
direcpc
direct
direcway
discovercard
docomo
doctor
dodo
dragonbbs
dream
drexel
drummondbank
dslextreme
duke
earmyu
earthling
earthlink
eartlink
eastwestbankhb
easylink
easynet
easyweb
eatel
eathlink
ebankinter
ebay
ecathay
ecom01
ecommerce
efirstbank
e-gold
eircom
ellaville
elmonte
elsitio
elvis
emirates
emporiki
enavigator
enbpb
engineer
epix
epochsystems
epost
eprimepoint
equinoxbank
erols
esbf
esmas
eteller
etimebanker
eurobancatrentino
eurobank
eurobell
euronet
europe
evbank
everestkc
evertrustbank
everyday
evolvebank
exba
excite
execpc
execs
execulink
executivebank
exite
express
ezweb
famvid
farmers
fast
fcbank
fcbca
fcbnet
fcbtampa
fcbusa
ffbh
fibanc
fidelity
fidnet
financial
finans
finansbank
fineco
firstamtrust
firstarizona
firstbankmiami
firstbanks
firstcitizens
firstcuracao
firstexpress
firstfederalsl
firstgorizon
firstimail
firstnationalbanks
firstregional
firsttennessee
firstusa
flagship3
flash
flexteller
f-mbank
fnbanksc
fnbanksuffield
fnbberryville
fnbca
fnblgmt
fnblhb
foothillindbank
fortis
fortisbusiness
fpsgold
fremontbank
frisurf
friulcassa
froggy
frontier
fsbanknet
fsbdover
fullertoncb
fultonsavings
fundsxpress
fuse
garanti
genie
geocities
get2net
gfswebbank
global
globetrotter
globo
gmail
gmedpp233
graffiti
grandecom
gruppocarige
gulftel
gvtc
halifax
halkbank
hanmi
hargray
hawaii
hccnet
headlandnationalbank
hehe
hetnet
highstream
hinet
hispeed
hiwaay
hkbn
hknet
hkstar
hnbhb
homtail
hongkong
hotail
hotbox
hotkey
hotmial
hotmil
hotpop
hot-shot
houston
hsbc
i-55
iafrica
iastate
ibank
ibercaja
ibill
ic24
i-cable
icbizbanker
ICMindex
ieee
ifrance
iglide
ihug
iinet
ikobo
iland
iname
indiana
indiatimes
indigo
indy
inetbanker
infi
infogroup
infonegocio
infonie
infosel
inicia
innernet
inorbit
inreach
insight
interaccess
intercreditbank
interia
intermonetary
intesabci
intrstar
inversis
invest
inwind
iowatelecom
iquest
isbank
iserv
isideonline
iupui
ivillage
iwon
jcom
jcsbank
johnsonbankcm
jpmorgan
jumpy
juniper
juno
justice
kaiserfederal
kakinhelp
kent
key.com
keybank
kimo
knology
kocbank
kolumbus
konnect
korea
kscable
kutxa
kuveytturk
lacaixa
lacajadecanarias
laposte
lasallefederal
lawyer
lbbw.de
libero
liberty-bank
libertysurf
lineone
lloydstsb
lmco
loanadministration
localnet
login
login.passport
login.yahoo
london
loomisfargo
loveable
luukku
lvcm
lycos
macau
macfcu
madasafish
maine
mainstreettrusthb
maktoob
mars
mbox
mchsi
mcleodusa
mechbank
mediaone
megalink
melon
menta
merchantsbankca
merchantsbk
merr
metrobank
metrocast
microsoft
midsouth
midwest
migente
millenniumbank
mindless
mindspring
mizzou
mmcable
mnbnewyork
modcombank
mohavestbank
moneybookers
moneymanagergps
montecito
montefoggia
montgomery
morganfed
mpinet
mtco
mtmckinleybankbusinesslink
mtu-net
multitel.it
musician
mutual
mvnt4.com
mweb
mybluelight
mycubp
myexcel
mynet
myrealbox
myself
myvzw
myway
navegalia
naver
nbarizona
nbnet
nbp1
netcabo
netcologne
netcom
netcourrier
netdoor
netins
netit
netnitco
netspace
netteller
netteller
net-up
netvigator
netzero
nexgo
nifty
nochex
noos
nordbbs.com
northbaybancorp
northcoastbank
northcountry
northernschoolsfcu
northernskiesfcu
northerntrust
northnet
northrim
ntelos
nwlink
nycap
oceansidebank
offshore
ofir
ohiosavings
onebox
onemain
onetel
online
onlineserv
openbank
optionslink
optonline.net
otenet
pacbell
pacific
pacifier
palisadebank
pandora
paradise
passwd
patagon
paybill
payrol
penn
peoplepc
pipeline
pisem
pitt
plasa
playful
pldi
plusintbank
pncbank
pobox
poczta
poetic
pop3
popaprilia
popolarebari
popso.it
popularbancaprivada
postmaster
powerup
premierbillpay
premiervalleybank
premierwestbank
prexar
primus
prioritybank
privat
prodigy
programmer
prosperitybank
provide
providian
prtc
psbtrust
pswd
purdue
quicknet
quik
quixnet
qwest
raiffeisen
rambler
rbsdigital
rcbank
rcnchicago
rconnect
realpeoplebank
redcent
reddingbankofcommerce
rediff
refcoprivateclient.com
regentsbank
regionsbank
roadrunner
rochester
rogers
runbox
ruraltorrent
ruralvia
rushmore
s142
saintly
salisburybank
sanostra
sanpaolo
sapo
sarafunds
sasktel
satx
savingsbank
sbbank
sccoast
scottsboro
scottvalleybank
screenname.aol.com
sdsbanksys
secure2
secure3
secureach
securityfederalbank
seductive
seed
segpay
sekerbank
selectbenefit.com
sella.it
semo
senet
sensewave
server28
server29
seznam
sharebuilder
sharebuilder.com
shaw
shentel
sify
sigecom
simsburybank
singnet
siol
sisna
site-secure
skynet
smartchat
smtp
snbank
snet
snip
socal
socket
softcom
sohu
solanobank
so-net
sonic
soon
southtrust
sover
speakeasy
sponsor2.ucmore.com
spray
sprint
sprynet
ssl.bsk.com.pl
standardbank
stanford
starband
starhub
starmedia
starpower
statebank
statementlook
stis
stny
stockmensbank
stormpay
strato
sunflower
sunnbnj
supereva
surewest
surfbest
surfeu
surfsouth
suscom
swbell
swfla
swing
swipnet
swirve
sympatico
synovus
tahoo
takasbank
talentg
talk21
tambank
tamil
tampabay
taylorbank
tdcadsl
teacher
techie
telcel
tele2
telefonica
teleline
teleport
teleweb
telia
telkom
telnor
telocity
telstra
telus
terra
tesco
texas
thatsmybank
theapplebank
thegrid
theriver
thevalidnetwork
thewiltonbank
tibbank
ticketsclub
tiscali
tninet
toast
todito
together
trade
trading
treasury
triad
triton
trustcobank
trustdirect
tutopia
tv.180solutions.com
twcny
twmi
txucom
uark
uboc
uboot
ucdavis
ucla
ucsd
uiowa
uiuc
ultrabranch
umich
umpire
unicaja
unioncolonybank
unionstate
unity
uno-e
ureach
usbank
uscentury
userid
username
users.ucmore.com
usersonlnet
usfamily
uswest
vakifbank
valleybankct
vanguard
vault
verizon
verotell
videotron
vintagebank
virgilio
virgin
VisaLink
vizzavi
vnet
vodafone
voicenet
voila
voyager
vsnl
vtown
vzavenue
walla
wamu
wanadoo
wans
warwick
wblnk
wcoil
wcom
web8
webaccess
web-access
webcashmgmt
webcashmgmt
webmail
webmail.aol.com
webpayservice
websterbank
webtv
wellsfargo
westernsecurity
westnet
weststarbank
whoever
whsmithnet
wideopenwest
wilberbank
winbank
windsorfederal
winning
winterthur
witty
wmconnect
wowway
writeme
wsnb
wwdb
www.internet-optimizer.com
wyoming
xmission
xs4all
xtra
yaga
yahho
yale
yandex
yaoo
yhaoo
yhoo
yolobank
yours
yucom
zeelandnet
ziplip
ziraatbank
zonnet
zoom
zwallet

System Changes

Files Added

• %WINDIR% \temp\$_2341233.tmp

• c:\program files\common files\microsoft shared\web folders
  \ibm00001.dll ( 66560 bytes )

• c:\program files\common files\microsoft shared\web folders
  \ibm00002.dll ( 69632 bytes )

• %WINDIR% \temp\$_2341234.tmp

• c:\program files\common files\microsoft shared\web folders
  \ibm00001.exe ( 3072 bytes )

Registry Details

The following registry keys are created:

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher

• hkey_current_user\software\microsoft\systemcertificates\acrs
  \certificates

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\certificates

• hkey_current_user\software\microsoft\systemcertificates\userds

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_current_user\software\microsoft\systemcertificates\acrs\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \crls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_current_user\software\microsoft\systemcertificates\authroot

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\crls

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\ctls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\ctls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\certificates

• hkey_current_user\software\microsoft\systemcertificates\acrs\crls

The following registry keys are written:

• hkey_current_user\software\microsoft\windows\currentversion\run
  \shell=""C:\Program Files\Common Files\Microsoft Shared\Web
  Folders\ibm00001.exe""

• hkey_local_machine\software\microsoft\windows nt\currentversion
  \winlogon\shell="explorer.exe
  
  "C:\Program Files\Common Files\Microsoft Shared\Web Folders
  \ibm00001.exe""

Symptoms

The application listens and transmits information on two random, high-numbered (above 5000) ports.  The applications creates the following network connection(s):

• explorer.exe server:dscteam.com port:80

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Bancos.LU (Panda)

Characteristics

Characteristics -

• The worm configures itself to load at startup. 

DNS Queries

• nordbbs.com  

• dscteam.com

Accessed URLs are monitored for the inclusion of particular strings.  If the strings exist, the client is redirected to a 'dummy' site, which is intended to mimic a legitimate banking site.  The strings include:

212.58.14.196
217.193.172.38
440strand.com
53.com
abaflex.com
abnamro.com
accesd.desjardins.com
account3000.com
accounts.key.com
accu.com.au
acmfunds.com
agf.com
alaskausa.org
aldenstate.net
allianceach.com
alpha.gr
anbusiness.com
angloconnect.com
anz.com.au
asp2.paybillag.com
auth4.jpmorgan.com
authzone.virtualbank.com
ba-ca.com
banca.cajaen.es
bancae.caixapenedes.com
bancopostaonline.poste.it
banesnet.banesto.es
banking.1822direkt.com
banking.firsttennessee.*
banking.ing-diba.de
banking.lbbw.de
banking.postbank.de
banking.raiffeisen.at
banking.seb.de
banking.uboc.com
bankingportal.naspa.de
bankofscotlandhalifax-online.co.uk
bankone.com
barclaygrp.com
barrington-bank.com
bbh.com
bbk.es
bbvanet.com
bbvanetoffice.com
bdc.ca
bdi.com.do
be.bancofar.es
bgk24biznes.pl
bise.pl
bmo.com
bnc.ca
bnpparibas.net
boi-bol.com
bosbank24.pl
bpd.com.do
bph.pl
bpr.it
bresa.com.pl
brokerage.comdirect.de
brokerage.lbbw.de
brownshipley.com
bsa.ad
bsgllc.net/cgi-bin
bsk.com.pl
businessnet.ba-ca.com
bznet.bancozaragozano.es
cahoot.com
caixasabadell.net
calvados2-enligne.credit-agricole.fr
capfed.com
carenet.fnfismd.com
carnet.cajarioja.es
cbcbank.com/olb
cbtfl.com
ccblv.net
cdg.citibank.de
centralbankus.com/secure
centrum24.pl
centurynational2.com
chaseonline.chase.com
cib.ibanking-services.com
cib.ibanking-services.com
cibc.com
cilme.it
citibusinessonline.da-us.citibank.com
citizensbank.ca
cnbsec1.cnbank
coma.comdirect.de
combnk.com
comerica.com
co-operativebank.co.uk
coral.co.uk
cortalconsors.de
csbnet.com
csccu.com
cunet.org
daiwasmbc.co.uk
dexia.sk
drussl.com
dscteam.com
dzbank.pl
ebancoval.bancoval.es
ebank.hsbc.co.uk
ebank.pinnbank.com
ec31.arl-tsg.com/svb-rtl/
ecorpla1.com/EBC_EBC1961
e-credit.ad
emigrant.com
emocorp.com
enlaza.cajadeburgos.es
enterprise1.openbank.com
esube.oyakbank.com.tr
etimebanker.bankofthewest.com
etimebanker.bankofthewest.com
etimebanker.bankofthewest.com
extranet.banesto.es
ezcardinfo.com
fairbairnpb.com
faithstouch.org
fbb.gr
ffsb.com
fiibg.com
fineco.it
firstib.com
firstpointe.com
flagship*.vanguard.com
flushingsavings.com
founders.com
gb24.pl
genfed.com
gironet.com
global1.onlinebank.com
global1.onlinebank.com
greencentury.com
gsjbwere.com
hampshire-trust.co.uk
heritagebankfl.com
hoaresbank.co.uk
hp.first-direct.com
hvbrsce.com
hwcm.com
ib.cbonline.co.uk
ib.nbonline.co.uk
ib.sfbank.co.uk
ibanc.bowc.com
ibank.barclays.co.uk
ibank.barclays.co.uk
ibank.cahoot.com
ibank.internationalbanking.barclays.com
ibre.com.pl
ing-diba.de
integrum.pl
interconnexio2.bibm.ad
internet724.vakifbank.com.tr
investing.schwab.com
investors.com
irnb.com
isube.disbank.com.tr
iurisbank.com
jbpb.com
kb24.pl
laiki.com
lbbwebclient.lehmanbank.com
mandtbank.com
meine.deutsche-bank.de
miamsales.com
militarybankonline.bankofamerica.com
millenet.pl
montevia.elmonte.es
mvelopes.com
my.if.com
my.if.com
myaccounts.navyfcu.org
mybank.alliance-leicester.co.uk
national.com.au
nationet.com
netbank.commbank.com
newton.co.uk
novaweb.gr
nvsl.com
nwolb.com
ohnward.com
oi.cajamadrid.es
oie.cajamadridempresas.es
olb2.nationet.com
online*.lloydstsb.*
online.ba-ca.com
online.sainsburysbank.co.uk
online.wellsfargo.com
onlinebanking.bankofoklahoma.com
onlinebanking-nw.bankofamerica.com
onlineid.bankofamerica.com
openplan.co.uk
orcobank.com
osufederal.com
pastornetempresas.bancopastor.es
pastornetparticulares.bancopastor.es
payentry.com
paypal.com
pcb.peoples.com
pcb.peoples.com
pcbank.sbdanbury.com
pcbanking.umb.com
pccaja.lacajadecanarias.es
pekao24.pl
peoples.com
peoples-state-bank.com
pictet.com
planters-bank.com
portal*.commerzbanking.de
postbank.de
poste.it
privati.intesabci.it
propay.com
r-bank.pl
retail.ncbelink.com
royalbank.com
sainsburysbank.co.uk
samba.com
schwab.com
scnb.com
seb.de
secure.griffonbank.com
secure.hnbfl.com
secure.ingdirect.co.uk
secure.mvnt4.com/tcf
secure.thebancorp.com
secure1.afba.com
secure-fcbflorida.com
sghambros.com
smile.
sso.uboc.com
standardlife.com
stgeorge.com.au
suncorpmetway.com.au
suntrust.com/portal
tcfexpressbusiness.com
tctrustco.com
tdwaterhouse.com
teleweb.com.tr
ticari.teleweb.com.tr
tpars.com
trust.firsttennessee.com
trustdirect.umb.com
trustweb.com
uboc.com
ubt.com
united-bk.com
uno-e.com
us.etrade.com
usb.com.cy
vcb.com
vr-ebanking.de
vub.sk
wallstreet-corp.co.ae
wc.floridacitizensbank
web.da-us.citibank.com
web.harborbank.com/hol
webbank.openplan.co.uk
web-banker.com/frostproof
webbanking.comerica.com
webid.gs.com
welcome*.co-operativebank.co.uk
welcome*.smile.co.uk
westlb.com
westpac.com.au
wnu.com
ww2.homebanking-*.de
www*.bancopopular.es
www*.fiibg.com
www.365online.com
www.ardil.bancogallego.es
www.arquia.es
www.bancamediolanum.it
www.banking.co.at
www.bankone.com
www.bv-i.bancodevalencia.es
www.caixalaietana.es
www.cajabadajoz.es
www.cajacanarias.es
www.cajavital.es
www.ccm.es
www.clavenet.net
www.dresdner-privat.de
www.ebank.us.hsbc.com
www.exactpay.com
www.firstib.com
www.halifax-online.co.uk
www.iblogin.com
www.jpmorganinvest.com
www.netxselect.com
www.nwolb.com
www.onlinesefcu.com
www.rbsdigital.com
www.selectbenefit.com
www.sella.it
www.sharebuilder.com
www.unicaja.es
www.virtualcu.net
www1.ibercajadirecto.com
www2.citizensbankonline.com
www2.site-secure.com
wwws.ameritrade.com
wwws.fibanc.es
wwws.sanostra.es
ykb.teleweb.com.tr

The worm also contains a keylogging component, which triggers when the user enters specific strings.  These strings include:

.ml.com
12move
1822direkt
1stfed
1stnatbank
1stnationalbank
1stpacbank
21cn
2by2
2die4
3web
aaahawk
aacfcu
abank
abbey
accesscomm
accountnumber
acninc
adams
addcom
adelphia
afbca
affinitybank
airtel
akbank
alabamacu
alaska
alaweb
albanybankandtrust2
albarakaturk
alliance-leicester
alliedcu
alltel
aloha
alpinebank
altapdonline
altavista
alum
americafirst
americanbusinessbank
americanriverbank
ameritech
amsouth
anbank
anbbank
another
ansbacher
antisocial
aodelink
appliedcardbank
AQResp
arcor
arkansas
arquia
arrakis
artisansbank
artlover
arvest
asahi-net
ashevillesavings2
asianavenue
astound
asyafinans
atlantic
attbi
auburn
aufcu
austarnet
austin
avantel
awesomenet
awfumc
banca
bancacrv
bancadelpiemonte
bancaintesa
bancaja
bancalombarda
bancamarch
bancaroma
bancasassari
banco
bancodevalencia
bancodisicilia
bancoetcheverria
bancofar
bancogallego
bancomadrid
bancomercantil
bancopastor
bancopopular
bancosardegna
bancourquijo
bancoval
bancozaragozano
banesto
banif
bankccb
bankcolonial
bankhapoalim
bankhiawassee
banking
bankjerusalem
bankleumi
bankoa
bankofalameda
bankofamerica
bankofantigua
bankofbermuda
bankofcyprus
bankofdelmarvahb
bankofdudley
bankofny
bankofoklahoma
bankofstockton
bankoftampa
bankofthewest
bankofutica
bankonsuperiorsavings
bankorient
bankwest
barclays
beaconfederal
beer
belgacom
bellsouth
bendcable
bendigobank
beneficial
bessemer
bestweb
bham
bidpay
bigfoot
bigpond
bikerider
billpaysite
bipop
bizcurrency
blackvoices
blilk
blueflamecu
bluewin
blueyonder
bolt
borel
boxfrog
bpavirtual
bpcbank
bpdbank
bper
bpmat
breathe
bredband
brentwoodbank
bresnan
bright
britanniainternational
broadpark
broadwayfed
broker
btclick
btconnect
budweiser
businessmanager
butterfield
bzwbk24
cableaz
cableinet
cablelynx
cableone
cablespeed
caixa
caixacatalunya
caixagalicia
caixaguissona
caixalaietana
caixamanlleu
caixaontinyent
caixapenedes
caixasabadell
caixatarragona
caja
cajacanarias
cajadeavila
cajadeburgos
cajaduero
cajaen
cajaespana
caja-granada
cajalaboral
cajalon
cajamadrid
cajamurcia
cajarioja
cajasegovia
cajastur
cajasur
cajavital
canada
cantv
canyonnational
capital
cardmemberservices
caribe
carispaq
carolina
carverbank
cassarimini
catlover
cayugalakenationalbank
cbbank
ccbill
ccbusa
celebrityx
centurybank
centurytel
champlainbank
chariot
charter
chase
cheerful
chello
chemicalbankmi
chemungwebach
chemungwebcorp
chinocommercialbank
chorus
chronopay
cinci
cisco
citibusiness
citicorp
citizensbanknc
citlink
citycu
citynet
cityntl
citywidebanks
clara
classicnet
clavenet
clemson
cliffhanger
clix
cmbank
cnbbartow
coastalnet
coastbankflorida
cobizbank
cogeco
collegeclub
colonialbk
colonya
colorado
columbia
columbus
comcast
comerica
comic
compaq
compassweb
comporium
compuserve
concentric
consultant
copper
coqui
core
cornell
countrybank
countybank
covad
crbna
creditunion
creval
crosslink
crownbank
csbankny
ctbatlantahb
cue-commerce
cukehb2
cuna
cunetbranch
cusa-hfs
cutey
cwnet
cyber
cypress-bank
darbybank
datacomm
da-us
dcbank
debitel
dejazzd
dellepro
denalifcu
deutsche-bank
dgmbank
dial
digitalbancorpbank
dircon
direcpc
direct
direcway
discovercard
docomo
doctor
dodo
dragonbbs
dream
drexel
drummondbank
dslextreme
duke
earmyu
earthling
earthlink
eartlink
eastwestbankhb
easylink
easynet
easyweb
eatel
eathlink
ebankinter
ebay
ecathay
ecom01
ecommerce
efirstbank
e-gold
eircom
ellaville
elmonte
elsitio
elvis
emirates
emporiki
enavigator
enbpb
engineer
epix
epochsystems
epost
eprimepoint
equinoxbank
erols
esbf
esmas
eteller
etimebanker
eurobancatrentino
eurobank
eurobell
euronet
europe
evbank
everestkc
evertrustbank
everyday
evolvebank
exba
excite
execpc
execs
execulink
executivebank
exite
express
ezweb
famvid
farmers
fast
fcbank
fcbca
fcbnet
fcbtampa
fcbusa
ffbh
fibanc
fidelity
fidnet
financial
finans
finansbank
fineco
firstamtrust
firstarizona
firstbankmiami
firstbanks
firstcitizens
firstcuracao
firstexpress
firstfederalsl
firstgorizon
firstimail
firstnationalbanks
firstregional
firsttennessee
firstusa
flagship3
flash
flexteller
f-mbank
fnbanksc
fnbanksuffield
fnbberryville
fnbca
fnblgmt
fnblhb
foothillindbank
fortis
fortisbusiness
fpsgold
fremontbank
frisurf
friulcassa
froggy
frontier
fsbanknet
fsbdover
fullertoncb
fultonsavings
fundsxpress
fuse
garanti
genie
geocities
get2net
gfswebbank
global
globetrotter
globo
gmail
gmedpp233
graffiti
grandecom
gruppocarige
gulftel
gvtc
halifax
halkbank
hanmi
hargray
hawaii
hccnet
headlandnationalbank
hehe
hetnet
highstream
hinet
hispeed
hiwaay
hkbn
hknet
hkstar
hnbhb
homtail
hongkong
hotail
hotbox
hotkey
hotmial
hotmil
hotpop
hot-shot
houston
hsbc
i-55
iafrica
iastate
ibank
ibercaja
ibill
ic24
i-cable
icbizbanker
ICMindex
ieee
ifrance
iglide
ihug
iinet
ikobo
iland
iname
indiana
indiatimes
indigo
indy
inetbanker
infi
infogroup
infonegocio
infonie
infosel
inicia
innernet
inorbit
inreach
insight
interaccess
intercreditbank
interia
intermonetary
intesabci
intrstar
inversis
invest
inwind
iowatelecom
iquest
isbank
iserv
isideonline
iupui
ivillage
iwon
jcom
jcsbank
johnsonbankcm
jpmorgan
jumpy
juniper
juno
justice
kaiserfederal
kakinhelp
kent
key.com
keybank
kimo
knology
kocbank
kolumbus
konnect
korea
kscable
kutxa
kuveytturk
lacaixa
lacajadecanarias
laposte
lasallefederal
lawyer
lbbw.de
libero
liberty-bank
libertysurf
lineone
lloydstsb
lmco
loanadministration
localnet
login
login.passport
login.yahoo
london
loomisfargo
loveable
luukku
lvcm
lycos
macau
macfcu
madasafish
maine
mainstreettrusthb
maktoob
mars
mbox
mchsi
mcleodusa
mechbank
mediaone
megalink
melon
menta
merchantsbankca
merchantsbk
merr
metrobank
metrocast
microsoft
midsouth
midwest
migente
millenniumbank
mindless
mindspring
mizzou
mmcable
mnbnewyork
modcombank
mohavestbank
moneybookers
moneymanagergps
montecito
montefoggia
montgomery
morganfed
mpinet
mtco
mtmckinleybankbusinesslink
mtu-net
multitel.it
musician
mutual
mvnt4.com
mweb
mybluelight
mycubp
myexcel
mynet
myrealbox
myself
myvzw
myway
navegalia
naver
nbarizona
nbnet
nbp1
netcabo
netcologne
netcom
netcourrier
netdoor
netins
netit
netnitco
netspace
netteller
netteller
net-up
netvigator
netzero
nexgo
nifty
nochex
noos
nordbbs.com
northbaybancorp
northcoastbank
northcountry
northernschoolsfcu
northernskiesfcu
northerntrust
northnet
northrim
ntelos
nwlink
nycap
oceansidebank
offshore
ofir
ohiosavings
onebox
onemain
onetel
online
onlineserv
openbank
optionslink
optonline.net
otenet
pacbell
pacific
pacifier
palisadebank
pandora
paradise
passwd
patagon
paybill
payrol
penn
peoplepc
pipeline
pisem
pitt
plasa
playful
pldi
plusintbank
pncbank
pobox
poczta
poetic
pop3
popaprilia
popolarebari
popso.it
popularbancaprivada
postmaster
powerup
premierbillpay
premiervalleybank
premierwestbank
prexar
primus
prioritybank
privat
prodigy
programmer
prosperitybank
provide
providian
prtc
psbtrust
pswd
purdue
quicknet
quik
quixnet
qwest
raiffeisen
rambler
rbsdigital
rcbank
rcnchicago
rconnect
realpeoplebank
redcent
reddingbankofcommerce
rediff
refcoprivateclient.com
regentsbank
regionsbank
roadrunner
rochester
rogers
runbox
ruraltorrent
ruralvia
rushmore
s142
saintly
salisburybank
sanostra
sanpaolo
sapo
sarafunds
sasktel
satx
savingsbank
sbbank
sccoast
scottsboro
scottvalleybank
screenname.aol.com
sdsbanksys
secure2
secure3
secureach
securityfederalbank
seductive
seed
segpay
sekerbank
selectbenefit.com
sella.it
semo
senet
sensewave
server28
server29
seznam
sharebuilder
sharebuilder.com
shaw
shentel
sify
sigecom
simsburybank
singnet
siol
sisna
site-secure
skynet
smartchat
smtp
snbank
snet
snip
socal
socket
softcom
sohu
solanobank
so-net
sonic
soon
southtrust
sover
speakeasy
sponsor2.ucmore.com
spray
sprint
sprynet
ssl.bsk.com.pl
standardbank
stanford
starband
starhub
starmedia
starpower
statebank
statementlook
stis
stny
stockmensbank
stormpay
strato
sunflower
sunnbnj
supereva
surewest
surfbest
surfeu
surfsouth
suscom
swbell
swfla
swing
swipnet
swirve
sympatico
synovus
tahoo
takasbank
talentg
talk21
tambank
tamil
tampabay
taylorbank
tdcadsl
teacher
techie
telcel
tele2
telefonica
teleline
teleport
teleweb
telia
telkom
telnor
telocity
telstra
telus
terra
tesco
texas
thatsmybank
theapplebank
thegrid
theriver
thevalidnetwork
thewiltonbank
tibbank
ticketsclub
tiscali
tninet
toast
todito
together
trade
trading
treasury
triad
triton
trustcobank
trustdirect
tutopia
tv.180solutions.com
twcny
twmi
txucom
uark
uboc
uboot
ucdavis
ucla
ucsd
uiowa
uiuc
ultrabranch
umich
umpire
unicaja
unioncolonybank
unionstate
unity
uno-e
ureach
usbank
uscentury
userid
username
users.ucmore.com
usersonlnet
usfamily
uswest
vakifbank
valleybankct
vanguard
vault
verizon
verotell
videotron
vintagebank
virgilio
virgin
VisaLink
vizzavi
vnet
vodafone
voicenet
voila
voyager
vsnl
vtown
vzavenue
walla
wamu
wanadoo
wans
warwick
wblnk
wcoil
wcom
web8
webaccess
web-access
webcashmgmt
webcashmgmt
webmail
webmail.aol.com
webpayservice
websterbank
webtv
wellsfargo
westernsecurity
westnet
weststarbank
whoever
whsmithnet
wideopenwest
wilberbank
winbank
windsorfederal
winning
winterthur
witty
wmconnect
wowway
writeme
wsnb
wwdb
www.internet-optimizer.com
wyoming
xmission
xs4all
xtra
yaga
yahho
yale
yandex
yaoo
yhaoo
yhoo
yolobank
yours
yucom
zeelandnet
ziplip
ziraatbank
zonnet
zoom
zwallet

System Changes

Files Added

• %WINDIR% \temp\$_2341233.tmp

• c:\program files\common files\microsoft shared\web folders
  \ibm00001.dll ( 66560 bytes )

• c:\program files\common files\microsoft shared\web folders
  \ibm00002.dll ( 69632 bytes )

• %WINDIR% \temp\$_2341234.tmp

• c:\program files\common files\microsoft shared\web folders
  \ibm00001.exe ( 3072 bytes )

Registry Details

The following registry keys are created:

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher

• hkey_current_user\software\microsoft\systemcertificates\acrs
  \certificates

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\certificates

• hkey_current_user\software\microsoft\systemcertificates\userds

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_current_user\software\microsoft\systemcertificates\acrs\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \crls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_current_user\software\microsoft\systemcertificates\authroot

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot

• hkey_local_machine\software\microsoft\enterprisecertificates
  \authroot\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpeople

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\crls

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \certificates

• hkey_current_user\software\policies\microsoft\systemcertificates
  \acrs\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpeople\crls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot

• hkey_current_user\software\microsoft\systemcertificates\authroot
  \ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpublisher\ctls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\certificates

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_current_user\software\policies\microsoft\systemcertificates
  \authroot

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\ctls

• hkey_local_machine\software\microsoft\enterprisecertificates
  \trustedpeople\ctls

• hkey_current_user\software\microsoft\systemcertificates
  \trustedpublisher\crls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\ctls

• hkey_local_machine\software\microsoft\systemcertificates
  \trustedpeople\ctls

• hkey_local_machine\software\policies\microsoft\systemcertificates
  \authroot\certificates

• hkey_current_user\software\microsoft\systemcertificates\acrs\crls

The following registry keys are written:

• hkey_current_user\software\microsoft\windows\currentversion\run
  \shell=""C:\Program Files\Common Files\Microsoft Shared\Web
  Folders\ibm00001.exe""

• hkey_local_machine\software\microsoft\windows nt\currentversion
  \winlogon\shell="explorer.exe
  
  "C:\Program Files\Common Files\Microsoft Shared\Web Folders
  \ibm00001.exe""

Symptoms

Symptoms -

The application listens and transmits information on two random, high-numbered (above 5000) ports.  The applications creates the following network connection(s):

• explorer.exe server:dscteam.com port:80

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A