Modified by: Jasen Sumalapao
ALIASES:

Trojan.Win32.Agent.tmhv (Kaspersky), Gen:Variant.Zusy.4398 (Bitdefender)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel: Dropped by other malware

This Trojan attempts to replace a system file with a copy of itself. This results to the crash of the affected computer.

This Trojan may be dropped by other malware.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size: 29,696 bytes
Memory Resident: Yes
Initial Samples Received Date: 24 Aug 2012
Payload: Modifies files

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_ARTIEF.BWZ

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

  • %System%\lsass.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lsass.exe = %System%\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
PendingFileRenameOperations = @\??\%System%\@%System%\lsass.exe.tmp

Other Details

This Trojan deletes itself after execution.

NOTES:

This Trojan attempts to replace the system file %System%\lsass.exe with a copy of itself. This results to the crash of the affected computer.

  SOLUTION

Minimum Scan Engine: 9.200
FIRST VSAPI PATTERN FILE: 9.346.08
FIRST VSAPI PATTERN DATE: 24 Aug 2012
VSAPI OPR PATTERN File: 9.347.00
VSAPI OPR PATTERN Date: 25 Aug 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by TROJ_INJECT.BWZ