Virus.Win32.Xpaj.gen

Technical Details
Payload
Removal instructions

Technical Details

This polymorphic file virus infects Windows executable files (PE). When infecting files the virus uses an entry point obscuring (EPO) technique. The virus body in the infected file varies from 160 to 180 KB.

Installation

When the infected file is launched, the virus saves files with arbitrary names based on computer parameters in a Windows folder. The files contain encrypted information about the virus.

Payload

The virus infects files stored in the folders:

• %system% (usually C:\Windows\system32\)
• %ProgramFiles% (usually C:\Program Files\)
• Files in shared folders
• Files on removable media, remote (network) disks and virtual disks (RAM), files prepared for the copying of CDs
• The following files that certain registry keys contain links to:

  Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Software\Microsoft\Internet Explorer\Extensions Software\Microsoft\Internet Explorer\UrlSearchHooks Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approv Software\Classes\Directory\ShellEx\ContextMenuHandlers
  Software\Classes\Folder\ShellEx\ContextMenuHandlers
  SOFTWARE\Classes\Protocol\Filter
  SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  SOFTWARE\Classes\Applications
  SOFTWARE\Clients\StartMenuInternet
  SOFTWARE\Microsoft\Multimedia
  SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

If the file does not satisfy certain conditions, e.g. it is protected with SFC, is will not be infected.

It attempts to connect to remote control servers indicated in the virus body. If server connections cannot be established, it attempts to connect to servers whose domain names are generated by the virus following a certain algorithm. The virus can download additional encrypted modules from the control server, which are then executed in the infected system.

Please note

Several variants of this virus are known to exist. This description was written for a version current in August 2011.

Removal instructions

If your computer does not have an up-to-date antivirus solution, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original infected file (the location will depend on how the program originally penetrated the victim machine).
2. Perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).