trojan downloader: Trojan-Downloader.Win32.Agent.a

Risk level: Medium

virus Description

The sample is to use the “VC” prepared by the Trojan downloaders, the size of 37,260 bytes, the icon for the virus ““, the extension “exe”, mainly through the “Web Trojan”, “file bundle”, “download tool download” modes to spread,
After the user’s computer was infected, the network will appear to run Slow, and unknown processes.

Infection of the operating system

Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission

Files binding, pages Trojan, download manager

Manual Solution:

1, manually delete the following files:
% SystemRoot% \ system32 \ WinHelp32.exe
2, delete to modify the Registry HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ 360safe

Variable declaration:

% SystemDriver% partition where the operating system, typically “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

Virus analysis:

1 after the execution of the sample, first check whether their path “% SystemRoot% \ system32 \ svchost.exe”. If the change in priority; create mutex “GNTWQ5TDNMXDGMZSGIXG64THHI4DAMBQ”; create threads for the operating system version information, sent to the specified URL. And modify the registry HKEY_LOCAL_MACHINE \ HARDWARE \ DESCRIPTION \ System \ CentralProcessor \ 0 ProcessorNameString
2 If not, check again whether the “% SystemRoot% \ system32 \ WinHelp32.exe”. If the failure classifies himself replaced WinHelp32.exe.
Call CreateProcessInternalA execute this file. Call the command to delete itself.
3 If WinHelp32.exe, create named 360safe service, start the service.
And create the registry key HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ 360safe item name Description.

The virus creates a file:

% SystemRoot% \ system32 \ WinHelp32.exe

Virus delete the file:

% SystemRoot% \ system32 \ WinHelp32.exe