Content

MalWarrior

Type
Trojan
SubType
Win32
Discovery Date
04/08/2008
Length
Varies
Minimum DAT
5270 (04/09/2008)
Updated DAT
5304 (05/27/2008)
Minimum Engine
5.1.00
Description Added
04/08/2008
Description Modified
04/08/2008 6:02 PM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.

 

The following registry entries are added:

  • HKEY_CURRENT_USER\Software\Adsl Software Limited\MalWarrior 2007\4.0
    InstallTime = Bin Data
  • HKEY_CURRENT_USER\Software\Adsl Software Limited\MalWarrior 2007\4.0
    Start Counter = Bin Data
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    MalWarrior = "%userprofile%\Application Data\Adsl Software Limited\MalWarrior 2007\Malwarrior.exe" /autorun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    DisplayName = "MalWarrior 2007 (ver. 4.0)"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
  • HelpLink = hxxp://[removed]
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: App Path = "C:\Program Files\MalWarrior 2007"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup Deselected Tasks = "desktopicon"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Icon Group = " MalWarrior 2007"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Selected Tasks = ""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Setup Version = "5.1.9"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: User = "Administrator"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    InstallDate = 20080408
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    InstallLocation = "C:\Program Files\MalWarrior 2007\"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    NoModify = Bin Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    NoRepair = Bin Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Publisher = "Adsl Software Limited"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    QuietUninstallString = "C:\Program Files\MalWarrior 2007\unins000.exe" /SILENT
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    UninstallString = "C:\Program Files\MalWarrior 2007\unins000.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    URLInfoAbout = [removed]
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    URLUpdateInfo = [removed]

The following files are added:

  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\Malwarrior.exe
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\program.ini
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\BASE\vbase.dat
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\LOG\20080408161741842.log
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\MalWarrior.exe
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\program.id
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\program.ini
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\BASE\vbase.dat
  • %ALLUSERSPROFILE%\Start Menu\Programs\MalWarrior 2007\MalWarrior 2007.lnk
  • %PROGRAMFILES%\MalWarrior 2007\MWLauncher.exe
  • %PROGRAMFILES%\MalWarrior 2007\unins000.dat
  • %PROGRAMFILES%\MalWarrior 2007\unins000.exe

Symptoms

Presence of aforementioned files and registry keys

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.  MalWarrior a trojan detection that displays fake alert messages on user's system.

Characteristics

Characteristics -

When run this trojan will run a scan and generate false detection alert messages and warnings like the one shown in the below.

 

The following registry entries are added:

  • HKEY_CURRENT_USER\Software\Adsl Software Limited\MalWarrior 2007\4.0
    InstallTime = Bin Data
  • HKEY_CURRENT_USER\Software\Adsl Software Limited\MalWarrior 2007\4.0
    Start Counter = Bin Data
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    MalWarrior = "%userprofile%\Application Data\Adsl Software Limited\MalWarrior 2007\Malwarrior.exe" /autorun
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    DisplayName = "MalWarrior 2007 (ver. 4.0)"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
  • HelpLink = hxxp://[removed]
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: App Path = "C:\Program Files\MalWarrior 2007"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup Deselected Tasks = "desktopicon"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Icon Group = " MalWarrior 2007"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Selected Tasks = ""
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: Setup Version = "5.1.9"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Inno Setup: User = "Administrator"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    InstallDate = 20080408
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    InstallLocation = "C:\Program Files\MalWarrior 2007\"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    NoModify = Bin Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    NoRepair = Bin Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    Publisher = "Adsl Software Limited"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    QuietUninstallString = "C:\Program Files\MalWarrior 2007\unins000.exe" /SILENT
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    UninstallString = "C:\Program Files\MalWarrior 2007\unins000.exe"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    URLInfoAbout = [removed]
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalWarrior 2007_is1
    URLUpdateInfo = [removed]

The following files are added:

  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\Malwarrior.exe
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\program.ini
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\BASE\vbase.dat
  • %APPDATA%\Adsl Software Limited\MalWarrior 2007\LOG\20080408161741842.log
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\MalWarrior.exe
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\program.id
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\program.ini
  • %ALLUSERSPROFILE%\Application Data\Adsl Software Limited\MalWarrior 2007\BASE\vbase.dat
  • %ALLUSERSPROFILE%\Start Menu\Programs\MalWarrior 2007\MalWarrior 2007.lnk
  • %PROGRAMFILES%\MalWarrior 2007\MWLauncher.exe
  • %PROGRAMFILES%\MalWarrior 2007\unins000.dat
  • %PROGRAMFILES%\MalWarrior 2007\unins000.exe

Symptoms

Symptoms -

Presence of aforementioned files and registry keys

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A