Content
Generic.dx!lzo
- Type
- Trojan
- SubType
- Discovery Date
- 01/28/2010
- Length
- Varies
- Minimum DAT
- 5875 (01/28/2010)
- Updated DAT
- 5919 (03/13/2010)
- Minimum Engine
- 5.2.00
- Description Added
- 01/28/2010
- Description Modified
- 02/09/2010 4:07 AM (PT)
Tab Navigation
Characteristics
Upon execution the trojan copies itself into the following location.
- %WinDir%\system32\wmimngr.exe
And drops the following files.
- %WinDir%\system32\wpmgr.exe
- %WinDir%\oracle.ocx (Hidden)
The following registry keys have been added to the system.
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5
The following registry value has been added to the system.
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
"StubPath:" = "%WinDir%\system32\wpmgr.exe"
The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
"%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"
The trojan registers the run entry to execute itself whenever the windows starts.
- [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
"Java micro kernel:" = "%WINDIR%system32\wpmgr.exe" - [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
"Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe" - [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
"Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"
The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key
- HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
“UACDisableNotify” = “ 0x00000001” - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA:" = "0x00000000"
The trojan disables the system restore function by modifying the following registry value
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"
The following registry values have been modified
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
"Start:"= "0x00000004" - [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
"Start:" = "0x00000004"
The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).
The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.
[Where %WinDir% is the Windows Directory - for example C:\Windows]
Symptoms
- Presence of above mentioned files and registry keys.
- Presence unexpected network connection to the above mentioned IP Address.
- The trojan is active in the process list.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
File Information
- MD5 - 4B33F1D40C570869276BEBE233FB9635
- SHA - 09D238691B976A7695951AF687B42B4DBE2379F0
- FileSize - 441,344 bytes
Aliases
- Ikarus - Worm.Win32.Prolaco
- Symantec - W32.Ackantta.G@mm
- Kaspersky - Backdoor.Win32.Wuca.ga
- F-Secure - Worm:W32/Prolaco.K
Characteristics
Characteristics -
Upon execution the trojan copies itself into the following location.
- %WinDir%\system32\wmimngr.exe
And drops the following files.
- %WinDir%\system32\wpmgr.exe
- %WinDir%\oracle.ocx (Hidden)
The following registry keys have been added to the system.
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
- HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5
The following registry value has been added to the system.
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
"StubPath:" = "%WinDir%\system32\wpmgr.exe"
The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
"%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"
The trojan registers the run entry to execute itself whenever the windows starts.
- [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
"Java micro kernel:" = "%WINDIR%system32\wpmgr.exe" - [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
"Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe" - [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
"Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"
The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key
- HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
“UACDisableNotify” = “ 0x00000001” - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA:" = "0x00000000"
The trojan disables the system restore function by modifying the following registry value
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"
The following registry values have been modified
- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
"Start:"= "0x00000004" - [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
"Start:" = "0x00000004"
The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).
The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.
[Where %WinDir% is the Windows Directory - for example C:\Windows]
Symptoms
Symptoms -
- Presence of above mentioned files and registry keys.
- Presence unexpected network connection to the above mentioned IP Address.
- The trojan is active in the process list.
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A