Content

Generic.dx!lzo

Type
Trojan
SubType
Discovery Date
01/28/2010
Length
Varies
Minimum DAT
5875 (01/28/2010)
Updated DAT
6561 (12/15/2011)
Minimum Engine
5.2.00
Description Added
01/28/2010
Description Modified
02/09/2010 4:07 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

Upon execution the trojan copies itself into the following location.

  • %WinDir%\system32\wmimngr.exe

And drops the following files.

  • %WinDir%\system32\wpmgr.exe
  • %WinDir%\oracle.ocx (Hidden)

The following registry keys have been added to the system.

  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5

The following registry value has been added to the system.

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
    "StubPath:" = "%WinDir%\system32\wpmgr.exe"

The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
    "%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"

The trojan registers the run entry to execute itself whenever the windows starts.

  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Java micro kernel:" = "%WINDIR%system32\wpmgr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
    "Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"

The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key

  • HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
    “UACDisableNotify” = “ 0x00000001”
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "EnableLUA:" = "0x00000000"

The trojan disables the system restore function by modifying the following registry value

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"

The following registry values have been modified

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
    "Start:"= "0x00000004"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
    "Start:" = "0x00000004"

The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).

The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.

[Where %WinDir% is the Windows Directory - for example C:\Windows]

Symptoms

  • Presence of above mentioned files and registry keys.
  • Presence unexpected network connection to the above mentioned IP Address.
  • The trojan is active in the process list.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

Variants

Variants

    N/A

All Information

Overview -

This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

File Information

  • MD5      - 4B33F1D40C570869276BEBE233FB9635
  • SHA      - 09D238691B976A7695951AF687B42B4DBE2379F0
  • FileSize  - 441,344 bytes


Aliases

  • Ikarus        - Worm.Win32.Prolaco
  • Symantec   - W32.Ackantta.G@mm
  • Kaspersky - Backdoor.Win32.Wuca.ga
  • F-Secure   - Worm:W32/Prolaco.K

Characteristics

Characteristics -

Upon execution the trojan copies itself into the following location.

  • %WinDir%\system32\wmimngr.exe

And drops the following files.

  • %WinDir%\system32\wpmgr.exe
  • %WinDir%\oracle.ocx (Hidden)

The following registry keys have been added to the system.

  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WAB\Profile5
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB
  • HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\WAB\Profile5

The following registry value has been added to the system.

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{IY5PT2EV-C68O-F6ER-1U30-C8N4T42W4OAP}\]
    "StubPath:" = "%WinDir%\system32\wpmgr.exe"

The trojan registers itself as an authorized application with the Windows Firewall by adding the following value to the registry key.

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\]
    "%WinDir%\system32\wfmngr.exe:"="%WinDir%\system32\wfmngr.exe:*:Enabled:Explorer"

The trojan registers the run entry to execute itself whenever the windows starts.

  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Java micro kernel:" = "%WINDIR%system32\wpmgr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\]
    "Windows Management:" = "C:\WINDOWS\system32\wmimngr.exe"
  • [HKEY_USERS\S-1-5-21-1454471165-926492609-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\]
    "Java micro kernel:" = "%WINDIR%\system32\wpmgr.exe"

The trojan disables the windows User Access Control (UAC) alerts by adding the following value to the registry key

  • HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Security Center]
    “UACDisableNotify” = “ 0x00000001”
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    "EnableLUA:" = "0x00000000"

The trojan disables the system restore function by modifying the following registry value

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore\] "DisableSR:"="0x00000001"

The following registry values have been modified

  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc\]
    "Start:"= "0x00000004"
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc\]
    "Start:" = "0x00000004"

The above mentioned registry entry confirms that, the trojan disables the Error Reporting Service (ERSvc) and Windows Security Center Service (wscsvc).

The trojan captures all keystrokes and stores that information into a hidden file "oracle.ocx". Also it connects to the IP address 204.13.[removed].126 through a remote port 443 to post that stolen information.

[Where %WinDir% is the Windows Directory - for example C:\Windows]

Symptoms

Symptoms -

  • Presence of above mentioned files and registry keys.
  • Presence unexpected network connection to the above mentioned IP Address.
  • The trojan is active in the process list.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, e-mail, etc.

Removal -

Removal -

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

Variants

Variants -

    N/A