Trojan-Dropper.Win32.Agent.cwsw

Technical Details
Payload
Removal instructions

Technical Details

This Trojan installs other programs on the computer without the user's knowledge. It is a Windows application (PE EXE file). It is 37 376 bytes in size. It is written in C++.

Payload

Once launched, the Trojan carries out the following actions:

• It terminates and deletes the service "COMServer".
• It deletes the following system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  "COMServer"
  

• It terminates the process "comsrvr.exe".
• It extracts from itself a file, which is then saved in the system as

  %System%\msapps\comsrvr.exe

  (29 696 bytes; detected by Kaspersky Anti-Virus as "Trojan-Downloader.Win32.Agent.eljy")
• It creates and launches in the system a service named "COMServer", the executable file for which is the previously extracted file.
• If it does not succeed in creating the service, the Trojan creates this system registry key:

  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  "COMServer" = "%System%\msapps\comsrvr.exe"
  

  This ensures that the file "comsrvr.exe" will be launched automatically each time the system is rebooted.
• The extracted file is then launched for execution.

The launched Trojan ("Trojan-Downloader.Win32.Agent.eljy") executes the functionality of a downloader. A connection is established with the following servers:

ccooo***o.cc
cccooo***o.cc

HTTP requests in the following format are sent to the above-mentioned hosts:

GET favicon.ico HTTP/1.1
Host: bcProxyBot.com
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg
Accept-Language: en-us
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.2.2.1)
Cookie: 000C29CBBE24<computer name>

In response to the request, the server sends a file, which the Trojan saves in the current user's temporary files directory "%Temp%" under a random name. Once downloaded, the file is launched for execution.

File downloading takes place in a cycle every 60 seconds.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Use Task Manager to terminate the process "comsrvr.exe".
2. Delete the following system registry key (see What is a system registry and how do I use it?):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "COMServer" = "%System%\msapps\comsrvr.exe"
   

3. Delete the system registry branches (see What is a system registry and how do I use it?):

   [HKLM\System\ControlSet001\Services\COMServer]
   [HKLM\System\CurrentControlSet\Services\COMServer]
   

4. Delete the following file:

   %System%\msapps\comsrvr.exe

5. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
6. Delete the files downloaded by the Trojan in the "%Temp%" directory.
7. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
8. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Trojan-Dropper. Hidden installation of other malicious programs in the system

Technical details

File size of 37376 bytes.

Malicious activity

Creates the following files:

• Windows system directory (usually, C:\Windows\System32) %System%\msapps\comsrvr.exe

Ensures subsequent Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

using system services:

Service name:	COMServer
Startup parameters	Windows system directory (usually, C:\Windows\System32) %System%\msapps\comsrvr.exe s
Startup type:	­automatic­

Launches files shown below for execution:

• Windows system directory (usually, C:\Windows\System32) %System%\msapps\comsrvr.exe

Other activities

Deletes the following parameters of the system registry keys:

[ System registry hive HKEY_CURRENT_USERHKCU\Software\Microsoft\Windows\CurrentVersion\Run ] "COMServer" = ""

Description:
­Used to automatically run files when the Windows OS boots­

Deletes the following files on an infected computer:

• Windows system directory (usually, C:\Windows\System32) %System%\msapps\comsrvr.exe