Content

Generic.dx!AC433467

Type
Trojan
SubType
-
Discovery Date
09/23/2008
Length
28997
Minimum DAT
5389 (09/22/2008)
Updated DAT
5389 (09/22/2008)
Minimum Engine
5.3.00
Description Added
09/23/2008
Description Modified
09/23/2008 10:35 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

File PropertyProperty Value
FileNameUnavailable
McAfee DetectionGeneric.dx
Length28,997 bytes
CRCAC433467
MD55D6C06E87958792C0C2515FFC1F30C42
SHA16A7FD94A9FD72A6C9504D9610A79B5EF5ECEC6EF

Avert® Labs has observed the following system activities:

ActivityRisk Level
Enumerates running processes
Medium
Writes executable in the windows folder
Low
Performs a shell execute of downloaded or existing files
Informational

Other detections that have been observed.

FileNameMcAfee Supported
%WINDIR%\winxp.dllGeneric.dx

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

  • %WINDIR%\system32\drivers\winsawids.sys
  • %WINDIR%\winxp.dll

    • The following registry elements have been created:

  • hkey_local_machine\system\controlset003\services\bits\parameters\
    • servicedll = c:\docume~1\admini~1\locals~1\temp\336078_res.tmp

    • The following registry elements have been changed:

  • hkey_local_machine\system\currentcontrolset\services\bits\parameters\
    • servicedll = c:\docume~1\admini~1\locals~1\temp\336078_res.tmp
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\a\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\c\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\d\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\e\
    • baseclass = drive

    • Symptoms

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

    Characteristics

    Characteristics -

    File PropertyProperty Value
    FileNameUnavailable
    McAfee DetectionGeneric.dx
    Length28,997 bytes
    CRCAC433467
    MD55D6C06E87958792C0C2515FFC1F30C42
    SHA16A7FD94A9FD72A6C9504D9610A79B5EF5ECEC6EF

    Avert® Labs has observed the following system activities:

    ActivityRisk Level
    Enumerates running processes
    		Medium
    Writes executable in the windows folder
    		Low
    Performs a shell execute of downloaded or existing files
    		Informational

    Other detections that have been observed.

    FileNameMcAfee Supported
    %WINDIR%\winxp.dllGeneric.dx

    System Changes

    These are general defaults for typical path variables. (Although they may differ, these examples are common.):
    %WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
    %SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
    %ProgramFiles% = \Program Files

    The following files have been added to the system:

  • %WINDIR%\system32\drivers\winsawids.sys
  • %WINDIR%\winxp.dll

    • The following registry elements have been created:

  • hkey_local_machine\system\controlset003\services\bits\parameters\
    • servicedll = c:\docume~1\admini~1\locals~1\temp\336078_res.tmp

    • The following registry elements have been changed:

  • hkey_local_machine\system\currentcontrolset\services\bits\parameters\
    • servicedll = c:\docume~1\admini~1\locals~1\temp\336078_res.tmp
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\a\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\c\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\d\
    • baseclass = drive
  • hkey_users\s-1-5-18\software\microsoft\windows\currentversion\explorer\mountpoints2\e\
    • baseclass = drive

    • Symptoms

    Symptoms -

    This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

    Method of Infection

    Method of Infection -

    Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

    Removal -

    Removal -

    AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A