English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan.Win32.Agent.aan

Detected Oct 31 2006 09:42 GMT
Released Oct 31 2006 09:42 GMT
Published Nov 10 2006 10:04 GMT

Technical Details
Payload
Removal instructions

Technical Details

This Trojan is designed to install other malicious programs. It is a Windows PE EXE file. The file is 19,456 bytes in size. It is packed using UPX. The unpacked file is approximately 40KB in size.


Payload

Once launched, the Trojan will:

  • create the following parameter in the system registry:
    [HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
     "load"="%System%\ssms.exe"
  • modify the value of the following parameter:
    [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
     "Hidden"="2"

The Trojan then checks the hard disk for the following file:

%Disk%:\RECYCLER\mshta.exe

If this file is not found, the Trojan will:

  1. Copy svids.dll from the Windows system directory under the following name:
    %Disk%:\RECYCLER\~
  2. Copy xastsvr.dll from the Windows system directory under the following name:
    %Disk%:\RECYCLER\mshta.exe

The Trojan then drops a file autorun.inf to the root partitions. This file contains the following strings:

[AutoRun]
open=RECYCLER\mshta.exe

As a result, when the user opens infected partitions using Explorer, mshta.exe will be launched from the opened partition.


Removal instructions

  1. Use Task Manager to terminate the Trojan process.
  2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
  3. Delete the following parameter from the system registry:
    [HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
    "load"="%System%\ssms.exe"
  4. Delete the following files from all hard disk partitions:
    %Disk%:\RECYCLER\mshta.exe
    %Disk%:\RECYCLER\~
    %Disk%:\autorun.inf
  5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Bookmark and Share
Share
Trojan

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.


Other versions