Generic PWS.y!C91DA1B9

Content

Generic PWS.y!C91DA1B9

Type: Trojan
SubType: Password
Discovery Date: 10/23/2008
Length: 397312
Minimum DAT: 5413 (10/23/2008)
Updated DAT: 5413 (10/23/2008)
Minimum Engine: 5.3.00
Description Added: 10/23/2008
Description Modified: 10/23/2008 11:35 AM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

File Property	Property Value
FileName	n2.exe
McAfee Detection	Generic PWS.y
Length	397,312 bytes
CRC	C91DA1B9
MD5	F173007FBD8E2190AF3BE7837ACD70A4
SHA1	BE71878C08544E093AB41F245C32E76259181BF8

Other Common Detection Aliases

Company Name	Detection Name
Dr.Web	DLOADER.PWS.Trojan
microsoft	trojanspy:win32/gimmiv.a
panda	Suspicious file
rising	Trojan.Spy.Win32.Undef.z
Sophos	Sus/Dropper-A

Avert® Labs has observed the following system activities:

Activity	Risk Level
Enumerates running processes	Medium
Uses shared memory of other processes	Low
Writes executable in the windows folder	Low
Performs a shell execute of downloaded or existing files	Informational

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files have been added to the system:

%WINDIR%\system32\wbem\sysmgr.dll

The following registry elements have been created:

hkey_local_machine\system\currentcontrolset\services\sysmgr\parameters\

servicedll = c:\windows\system32\wbem\sysmgr.dll
servicemain = servicemainfunc

The following registry elements have been changed:

hkey_local_machine\software\microsoft\windows nt\currentversion\svchost\

sysmgr = sysmgr

The applications created the following network connection(s):

http

hxxp://59.106.145.58/**********************

Symptoms

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.