Generic.dx!CF359010

Content

Generic.dx!CF359010

Type: Trojan
SubType: -
Discovery Date: 10/15/2008
Length: 679936
Minimum DAT: 5406 (10/15/2008)
Updated DAT: 5406 (10/15/2008)
Minimum Engine: 5.3.00
Description Added: 10/15/2008
Description Modified: 10/15/2008 10:57 AM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

File Property	Property Value
FileName	cam.exe
McAfee Detection	Generic.dx
Length	679,936 bytes
CRC	CF359010
MD5	154B540C6AF18B390AD18FE7F21A5B92
SHA1	651A08B4E6852CAA234787A6F00D20B6B39AED21

Other Common Detection Aliases

Company Name	Detection Name
avast	Win32:Agent-ABFS
AVG (GriSoft)	generic11.batu
Avira	TR/Crypt.XPACK.Gen
Kaspersky	Trojan.Win32.Buzus.aayj
microsoft	trojan:win32/ircbrute
norman	malware.eduw
panda	Suspicious file

Avert® Labs has observed the following system activities:

Activity	Risk Level
Modifies memory of other processes	Critical
Enumerates open windows	Medium
Enumerates running processes	Medium
Program often suspends itself	Medium
Uses shared memory of other processes	Low
Creates registry keys and data values to persist on OS reboot	Informational
Registers DLLs	Informational

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

%ALLUSERSPROFILE%\application data\temp

%PROGRAMFILES%\common files\system\klass.exe

The following registry elements have been created:

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\

(default) = tf_msaacontrol

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\bzwk\

(default) = xfnriyr@rja[oydfhgagaqx
(default) = xfnriyr@rjaxoydfhmcbok@

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\inprocserver32\

(default) = c:\windows\system32\msctf.dll
threadingmodel = apartment

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\pwvkcukandpa\

(default) = jddvkvsjnwag[xdvy
(default) = jdgvkvsjnwag[xdvy

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\rwtkxnwyndfye\

(default) = rhjmnyey|gnsc\^tz^qr\{h

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\stgcpzyr\

(default) = grcdln^}}ni]qagl@nhlt}}{
(default) = grcdln^}}ni]qagl@nklt}}{

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\uhiy\

(default) = az^b~je_^mdpeoj}xa`luh

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\vudvx\

(default) = saznlt@zbzw\bkovyvj~it

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\zcihb\

(default) = coamiiynycwbeef~n`rdyu}gf

hkey_local_machine\software\classes\clsid\{f8a84ce8-dfea-8821-f8a8-4ce8f8a84ce8}\zsdzcpzh\

(default) = essopqwch\|tbna_zueqqw

hkey_local_machine\software\licenses\

{0dfea8821cae2818d} = [binary data]
{idfea8821cae2818d} = 1
{idfea8821cae2818d} = 2
{idfea8821cae2818d} = 3
{idfea8821cae2818d} = 4
{idfea8821cae2818d} = 5
{idfea8821cae2818d} = 6
{k7c0db872a3f777c0} = [binary data]
{r7c0db872a3f777c0} = 345626

hkey_local_machine\software\microsoft\rfc1156agent\currentversion\parameters\

trappolltimemillisecs = 1080

hkey_local_machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\

c:\program files\common files\system\klass.exe = c:\program files
\common files\system\klass.exe:*:enabled:windows update

The following registry elements have been changed:

hkey_local_machine\software\microsoft\wbem\wdm\

c:\windows\system32\advapi32.dll[mofresourcename] = lowdatetime
:1981630464,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\dnsapi.dll[mofresource] = lowdatetime:1981630464
,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\drivers\acpi.sys[acpimofresource] = lowdatetime
:1981630464,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\drivers\processr.sys[processorwmi] = lowdatetime
:1981630464,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\kerberos.dll[mof_resource] = lowdatetime
:1981630464,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\lsass.exe[lsamofresource] = lowdatetime:1981630464
,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\msv1_0.dll[mofresource] = lowdatetime:1981630464
,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\netlogon.dll[mofresource] = lowdatetime:1981630464
,highdatetime:29436816***binary mof compiled successfully
c:\windows\system32\spoolsv.exe[spooler] = lowdatetime:1981630464
,highdatetime:29436816***binary mof compiled successfully

hkey_local_machine\software\microsoft\windows\currentversion\run\

windows update = c:\program files\common files\system\klass.exe

The applications created the following network connection(s):

chan.estr.es:6667 (irc)

NICK [nLh-VNC]ammval
NICK [nLh-VNC]ammval USER jcrjhcklx "fo8.net" "rage" :jcrjhcklx
NICK [nLh-VNC]ammval
USER jcrjhcklx "fo8.net" "rage" :jcrjhcklx JOIN #VNC 2008

Symptoms

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.