Content

Generic.dx!lzo

Type
Trojan
SubType
Discovery Date
01/28/2010
Length
Varies
Minimum DAT
5875 (01/28/2010)
Updated DAT
5919 (03/13/2010)
Minimum Engine
5.2.00
Description Added
01/28/2010
Description Modified
02/09/2010 4:07 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

Upon execution the trojan copies itself into the following location.

  • %WinDir%\system32\wmimngr.exe

And drops the following files.

  • %WinDir%\system32\wpmgr.exe
  • %WinDir%\oracle.ocx (Hidden)

The following registry keys have been added to the system.

  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5

The following registry value has been added to the system.

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
    "StubPath:" = "%WinDir%\system32\wpmgr.exe"

The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
    "%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"

The trojan registers the run entry to execute itself whenever the windows starts.

  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Java micro kernel:" = "%WINDIR%system32\wpmgr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
    "Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"

The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key

  • HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
    “UACDisableNotify” = “ 0x00000001”
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "EnableLUA:" = "0x00000000"

The trojan disables the system restore function by modifying the following registry value

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"

The following registry values have been modified

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
    "Start:"= "0x00000004"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
    "Start:" = "0x00000004"

The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).

The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.

[Where %WinDir% is the Windows Directory - for example C:\Windows]

Symptoms

  • Presence of above mentioned files and registry keys.
  • Presence unexpected network connection to the above mentioned IP Address.
  • The trojan is active in the process list.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

File Information

  • MD5      - 4B33F1D40C570869276BEBE233FB9635
  • SHA      - 09D238691B976A7695951AF687B42B4DBE2379F0
  • FileSize  - 441,344 bytes


Aliases

  • Ikarus        - Worm.Win32.Prolaco
  • Symantec   - W32.Ackantta.G@mm
  • Kaspersky - Backdoor.Win32.Wuca.ga
  • F-Secure   - Worm:W32/Prolaco.K

Characteristics

Characteristics -

Upon execution the trojan copies itself into the following location.

  • %WinDir%\system32\wmimngr.exe

And drops the following files.

  • %WinDir%\system32\wpmgr.exe
  • %WinDir%\oracle.ocx (Hidden)

The following registry keys have been added to the system.

  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5

The following registry value has been added to the system.

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
    "StubPath:" = "%WinDir%\system32\wpmgr.exe"

The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
    "%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"

The trojan registers the run entry to execute itself whenever the windows starts.

  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Java micro kernel:" = "%WINDIR%system32\wpmgr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
    "Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"

The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key

  • HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
    “UACDisableNotify” = “ 0x00000001”
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "EnableLUA:" = "0x00000000"

The trojan disables the system restore function by modifying the following registry value

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"

The following registry values have been modified

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
    "Start:"= "0x00000004"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
    "Start:" = "0x00000004"

The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).

The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.

[Where %WinDir% is the Windows Directory - for example C:\Windows]

Symptoms

Symptoms -

  • Presence of above mentioned files and registry keys.
  • Presence unexpected network connection to the above mentioned IP Address.
  • The trojan is active in the process list.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A