Trojan-Ransom.Win32.XBlocker.bct

Technical Details
Payload
Removal instructions

Technical Details

This Trojan stops the computer from functioning normally in order to obtain a ransom for restoring the system to its initial condition. It is a Windows application (PE EXE file). It is 73 216 bytes in size. It is written in C++.

Installation

Once launched, the Trojan copies its body to the file:

%ALLUSERSPROFILE%\TempDir\mspro32.scr

Scripts are also created for the command interpreter:

%ALLUSERSPROFILE%\TempDir\rdb.bat (96 bytes)
%ALLUSERSPROFILE%\TempDir\start.bat (71 bytes)

The scripts contain the following strings, in corresponding order:

@echo off
cd %ALLUSERSPROFILE%\TempDir\
echo>"mspro32.scr:Zone.Identifier"

@echo off
cd %ALLUSERSPROFILE%\TempDir\
mspro32.scr

To ensure that the copy created is launched automatically each time the system is rebooted, the following system registry key is created:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"AAPatch" = "%allusersprofile%\TempDir\start.bat"

The Trojan also disables the User Account Control (UAC) by changing the system registry key value:

[HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

The Trojan then launches the previously created copy for execution and ceases running.

Payload

Once launched, the Trojan carries out the following actions:

• It creates the following registry key:

  [HKLM\Software\LtuSoftware]
  "Prefix" = "8638"
  

• It references the system registry key in a continuous cycle, thus preventing it from being changed:

  [HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system]
  "EnableLUA"
  

• In a continuous cycle, it checks in the system for the presence of the Task Manager process "taskmgr.exe". If the process is launched, the Trojan terminates it
• In the lower-right corner of the screen, it displays a window with the following content:

  

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Terminate the Trojan process. To do so, launch the system command interpreter "cmd.exe" and execute the following command in it:

   taskkill /f /im mspro32.scr

2. Delete the following files:

   %ALLUSERSPROFILE%\TempDir\mspro32.scr
   %ALLUSERSPROFILE%\TempDir\rdb.bat 
   %ALLUSERSPROFILE%\TempDir\start.bat 
   

3. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
4. Delete the following system registry keys (see What is a system registry and how do I use it?):

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "AAPatch" = "%allusersprofile%\TempDir\start.bat"
   
   [HKLM\Software\LtuSoftware]
   "Prefix" = "8638"
   

5. Restore the initial system registry key value (see What is a system registry and how do I use it?):

   [HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system]
   "EnableLUA"
   

6. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Summary

• Trojan-Spy. Spies upon user's activity

• Trojan-Dropper. Hidden installation of other malicious programs in the system

• Trojan. Changes the system settings of a computer

• Performs potentially dangerous activity

Technical details

File size of 73216 bytes.

Installation

Makes copies of itself with the following names once launched:

• Directory of users' settings%Documents and Settings%\All Users\TempDir\mspro32.scr

Creates the following files on an infected computer:

• Directory of users' settings%Documents and Settings%\All Users\TempDir\rdb.bat

Malicious activity

Tracks user activity by installing system hooks:

• ­Intercept key presses­

Creates the following files:

• Directory of users' settings%Documents and Settings%\All Users\TempDir\start.bat

Ensures subsequent Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of installed files:

by adding values to autorun keys in the system registry:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ] "AAPatch" = " Directory of users' settings%Documents and Settings%\All Users\TempDir\start.bat"

Modifies (or deletes) system registry keys in order to restrict Windows functionality:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system ] "EnableLUA" = "0x0"

Installs system hooks which:

• ­Track mouse movement­

Other activities

Runs the following files (commands):

• Directory of users' settings%Documents and Settings%\All Users\TempDir\mspro32.scr

Unloads the following processes from the memory:

• procexp.exe

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\LtuSoftware ] "Prefix" = "0x4E4"