Generic.dx!zi!1958aa4e01e3

Content

Generic.dx!zi!1958aa4e01e3

Type: Trojan
SubType: -
Discovery Date: 07/14/2009
Length: 193024
Minimum DAT: 5676 (07/14/2009)
Updated DAT: 5676 (07/14/2009)
Minimum Engine: 5300.2777
Description Added: 07/14/2009
Description Modified: 07/14/2009 9:56 PM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

File Property	Property Value
FileName	foto04~1.exe
McAfee Artemis	Artemis!1958aa4e01e3
McAfee Detection	Generic.dx!zi
Length	193,024 bytes
CRC	7719C453
MD5	1958AA4E01E3A29EF0C74C074D919119
SHA1	32AAC08DA9EE1274768A5BC75267A9DA03102C6C

Other Common Detection Aliases

Company Name	Detection Name
avast	Win32:Trojan-gen {Other}
Avira	TR/Crypt.CFI.Gen
BitDefender	Gen:Trojan.Heur.B080E1F4F4
eSafe (Alladin)	suspicious Trojan/Worm [101]
F-Prot	W32/Banload.E.gen!Eldorado
norman	W32/Obfuscated.B!genr
Sophos	Mal/Generic-A
Symantec	Suspicious.MH690
Trend Micro	TROJ_DLOAD.QS

Avert® Labs has observed the following system activities:

Activity	Risk Level
Enumerates open windows	Medium
Uses shared memory of other processes	Low

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files were analyzed:

%USERPROFILE%\local settings\temp\foto04~1.exe

The following files have been added to the system:

c:\winnt_\winnt2.txt

c:\winnt_\winnt3.txt

c:\winnt_\winnt4.txt

c:\winnt_\winnt5.txt

c:\winnt_\winnt6.txt

c:\winnt_\winntr1.exe

c:\winnt_\winntr1.txt

c:\winnt_\winntr2.txt

The following registry elements have been changed:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\currentversion\run\

winnt2 = c:\winnt_\winnt2.exe
winnt3 = c:\winnt_\winnt3.exe
winnt4 = c:\winnt_\winnt4.exe
winnt5 = c:\winnt_\winnt5.exe
winnt6 = c:\winnt_\winnt6.exe
winntr1 = c:\winnt_\winntr1.exe
winntr2 = c:\winnt_\winntr2.exe

The applications created the following network connection(s):

http

hxxp://****************

Symptoms

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.