McAfee > Theat Center > Virus Detail Page

Overview

--

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Downloaders are designed to pull files from a remote Website and execute the files that have been downloaded. This downloader variant has exhibited the following characteristics:

Upon execution, this malware drops the following file to run at startup and deletes the original file:

• %SysDir%\Documents and Settings\%USER%\Start Menu\Programs\Startup\rncsys32.exe

A logfile is also created here:

• %SysDir%\Documents and Settings\%USER%\Application Data\wiaserva.log

The following registry key is created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags

The following data/value pair is added:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers "C:\WINDOWS\explorer.exe"
  Data: EnableNXShowUI

It will then attempt connect to a command and control server and download further malware from the following address:

• 78.109.29.116

The malware may also attempt to disable antivirus, Windows updates, and firewalls.

Symptoms

• Presence of aforementioned file and registry values.
• Presence of connections to the aforementioned address.

Method of Infection

This purpose of this trojan is simply to download a file from the Internet and execute it. It does not self-replicate. Downloader trojans are frequently sent in spammed emails designed to entice the recipient into running the file. Other likely distribution channels for this trojan include via IRC, via peer-to-peer file-sharing networks, as an attachment in newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

-- Update July 1, 2009 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.theregister.co.uk/2009/07/01/torrentreactor_breach/

--

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

Downloaders are designed to pull files from a remote Website and execute the files that have been downloaded. This downloader variant has exhibited the following characteristics:

Upon execution, this malware drops the following file to run at startup and deletes the original file:

• %SysDir%\Documents and Settings\%USER%\Start Menu\Programs\Startup\rncsys32.exe

A logfile is also created here:

• %SysDir%\Documents and Settings\%USER%\Application Data\wiaserva.log

The following registry key is created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags

The following data/value pair is added:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers "C:\WINDOWS\explorer.exe"
  Data: EnableNXShowUI

It will then attempt connect to a command and control server and download further malware from the following address:

• 78.109.29.116

The malware may also attempt to disable antivirus, Windows updates, and firewalls.

Symptoms

Symptoms -

• Presence of aforementioned file and registry values.
• Presence of connections to the aforementioned address.

Method of Infection

Method of Infection -

This purpose of this trojan is simply to download a file from the Internet and execute it. It does not self-replicate. Downloader trojans are frequently sent in spammed emails designed to entice the recipient into running the file. Other likely distribution channels for this trojan include via IRC, via peer-to-peer file-sharing networks, as an attachment in newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A