Generic.dx!AECE0144

Content

Generic.dx!AECE0144

Type: Trojan
SubType: -
Discovery Date: 10/13/2008
Length: 187392
Minimum DAT: 5404 (10/13/2008)
Updated DAT: 5404 (10/13/2008)
Minimum Engine: 5.3.00
Description Added: 10/13/2008
Description Modified: 10/13/2008 10:52 AM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

File Property	Property Value
FileName	lphc78~1.exe
McAfee Detection	Generic.dx
Length	187,392 bytes
CRC	AECE0144
MD5	AF256EB3CF4DAA2DE04CB8AC3CC7786C
SHA1	4416FA11005BAC44A1DA9E767400ED46F368075E

Other Common Detection Aliases

Company Name	Detection Name
AVG (GriSoft)	SHeur.CODO (Trojan horse)
eSafe (Alladin)	Suspicious file
FortiNet	Suspicious
Kaspersky	Trojan-Downloader.Win32.Small.afap
microsoft	VirTool:Win32/Obfuscator.CK (suspicious)
panda	Suspicious
Sophos	Mal/EncPk-CZ
V-Buster	Trojan.FakeAlert.Gen!Pac.2

Avert® Labs has observed the following system activities:

Activity	Risk Level
Modifies the operating system security policy	Critical
Enumerates running processes	Medium
Uses shared memory of other processes	Low
Writes executable in the windows folder	Low
Creates registry keys and data values to persist on OS reboot	Informational

Other detections that have been observed.

FileName	McAfee Supported
%WINDIR%\system32\phcco1j0e77r.bmp	Fakealert!bmp
%WINDIR%\system32\blphcco1j0e77r.scr	FakeAlert-AG.gen.a
%USERPROFILE%\local settings\temp\.tt2.tmp.vbs	VBS/FakeAlert-AB

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

%WINDIR%\system32\blphcco1j0e77r.scr

%WINDIR%\system32\phcco1j0e77r.bmp

The following registry elements have been created:

hkey_local_machine\software\microsoft\software notifier\

installid = dfc52c9e-ca62-4e16-9a22-1f05eafeb73f

hkey_users\s-1-5-21-1202660629-602609370-839522115-500\software\microsoft\windows\currentversion\policies\system\

nodispbackgroundpage = 1
nodispscrsavpage = 1

hkey_users\s-1-5-21-1202660629-602609370-839522115-500\software\sysinternals\bluescreen screen saver\

eulaaccepted = 1

The following registry elements have been changed:

hkey_local_machine\software\microsoft\windows\currentversion\run\

lphcco1j0e77r = c:\windows\system32\lphcco1j0e77r.exe

hkey_users\s-1-5-21-1202660629-602609370-839522115-500\control panel\colors\

background = 0 0 255

hkey_users\s-1-5-21-1202660629-602609370-839522115-500\control panel\desktop\

convertedwallpaper = c:\windows\system32\phcco1j0e77r.bmp
originalwallpaper = c:\windows\system32\phcco1j0e77r.bmp
screensaveactive = 49
screensavetimeout = 3158070
scrnsave.exe = c:\windows\system32\blphcco1j0e77r.scr
tilewallpaper = 48
wallpaper = c:\windows\system32\phcco1j0e77r.bmp
wallpaperstyle = 48

The applications created the following network connection(s):

http

hxxp://windowsupdate.microsoft.com/
hxxp://windowsupdate.microsoft.com/images/1186435687
/6792735b864d490edcc016d74cb6f142
/*****************************************

Symptoms

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.