Trojan-Downloader.Win32.Small.bah

Technical Details

This Trojan is a Windows PE EXE file. It is approximately 27KB in size.

Installation

Once launched, the Trojan copies its executable file to the Windows system directory:

In order to ensure that the Trojan is launched automatically each time the system is booted, the Trojan adds a link to its executable file in the system registry:

Once installed, the Trojan deletes its original executable file.

Payload

The Trojan disables antivirus protection on the victim machine by:

• disabling services with the following names:
  RsRavMon
  RsCCenter
  Kavsvc
  KVSrvXP
  Wscsvc
  KPfwSvc
  KwatchSvc
  SNDSrvc
  ccProxy
  ccEvtMgr
  ccSetMgr
  SPBBCSvc
  Symantec Core LC
  Navapsvc
  NPFMntor
  MskService
  FireSvc
  McShield
  McTaskManager
  McAfeeFramework
• deleting from the following registry key:
  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

  parameters with the names listed below:

  KAVPersonal50
  RavMon
  RavTimer
  KvMonXP
  iDuba Personal FireWall
  KAVRun
  KpopMon
  Kulansyn
  KavPFW
  ccApp
  SSC_UserPrompt
  NAV CfgWiz
  MCAgentExe
  McRegWiz
  MCUpdateExe
  MSKAGENTEXE
  MSKDetectorExe
  VirusScan Online
  VSOCheckTask
  McAfeeUpdaterUI
  ShStatEXE
  VSOCheckTask
  KavStart
  Services
  KWatch9x
  Csoftok
  explor.exe
  windos
• terminating the following processes:
  FireTray.exe
  UpdaterUI.exe
  TBMon.exe
  SHSTAT.EXE
  RAV.EXE
  RAVMON.EXE
  RAVTIMER.EXE
  KVXP.KXP
  KVCENTER.KXP
  Iparmor.exe
  MAILMON.EXE
  KAVPFW.EXE
  KmailMon.EXE
  KAVStart.exe
  KATMain.EXE
  TrojanDetector.EXE
  KVFW.EXE
  KVMonXP.KXP
  KAVPLUS.EXE
  KWATCHUI.EXE
  KPOPMON.EXE
  KAV32.EXE
  CCAPP.EXE
  MCAGENT.EXE
  MCVSESCN.EXE
  MSKAGENT.EXE
  EGHOST.EXE
  KRegEx.exe
  TrojDie.kxp
  KVOL.exe
  kvolself.exe
  KWatch9x.exe
  SOFTOK.EXE
  explor.exe
  windox.exe

  The Trojan harvests QQMessenger account data. It scans the system for log-in windows associated with this program. If it finds such windows it harvest text entered in the files and saves them to the following log file:

  %WinDir%\Media\chord.waz

  The log file will periodically be sent to the remote malicious user by email.

  
  

  Removal instructions

  If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

  1. Use Task Manager to terminate the malicious program’s process.
  2. Delete the following system registry key parameter:
     [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
     "NTdhcp" = "%System%\NTdhcp.exe"
  3. Delete the following files:
     %System%\NTdhcp.exe
     %WinDir%\Media\chord.waz
  4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus)..