TR/Dldr.Bagle.BR - Trojan

See also

Full description

Alias:	Email-Worm.Win32.Bagle., W32/Bagle.dll.dr, Trojan.Tooso.F, TROJ_BAGLE.B, Troj/BagleDl, Win32.Bagle.B*@mm
Type:	Trojan
Size:	36.352 Bytes
Origin:
Date:	05-31-2005
Damage:
VDF Version:	6.30.00.215 - Tue, 31 May 2005 16:52 (GMT+1)
Danger:	Low
Distribution:	Medium

General Description[Affected platforms]
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

[Damage routine]
* terminates antivirus- und securitysoftware
* downloads other trojan components
* deletes values from the Windows Registry

Technical DetailsIf TR/Dldr.Bagle.BR is executed, it creates in the Windows system directory (on Microsoft Windows 9x <%WinDIR%>System\ and on Microsoft Windows NT/2000/XP/2003 <%WinDIR%>\System32\) the following files:

<%sysdir%>\WIWSHOST.EXE (filesize: 11.774 bytes)

The trojan adds two entries in the Windows Regsitry:

[HKEY_Current_User\Software\Microsoft\ Windows\CurrentVersion\Run]
"winshost.exe" = "<%sysdir%>\winshost.exe"

[HKEY_Local_Machine\Software\Microsoft \Windows\CurrentVersion\Run]
"winshost.exe" = "<%sysdir%>\winshost.exe"

The file WIWSHOST.EXE is actually the downloader. It is also able to affect the efficiency of antivirus- and securitysoftware.
It modifies the Windows HOSTS file, so that different web sites from software producers get blocked and thus they aren't reachable anymore.

The trojan is also able to terminate a range of processes from antivirus- and securitysoftware. To avvomplish this task, the virus terminates all active processes which contain one of the following strings within the processname:

- wuauserv
- PAVSRV
- PAVFNSVR
- PSIMSVC
- Pavkre
- PavProt
- PREVSRV
- PavPrSrv
- ccSetMgr.exe
- SPBBCSvc
- KLBLMain
- avg7alrt
- avg7updsvc
- vsmon
- CAISafe
- avpcc
- fsbwsys
- backweb client - 4476822
- backweb client-4476822
- fsdfwd
- F-Secure Gatekeeper Handler Starter
- FSMA
- KAVMonitorService
- navapsvc
- NProtectService
- Norton Antivirus Server
- VexiraAntivirus
- dvpinit
- dvpapi
- schscnt
- BackWeb Client - 7681197
- F-Secure Gatekeeper Handler Starter
- FSMA
- AVPCC
- KAVMonitorService
- Norman NJeeves
- NVCScheduler
- nvcoas
- Norman ZANDA
- PASSRV
- SweepNet
- SharedAccess
- navapsvc
- NPFMntor
- Outpost Firewall
- SAVScan
- SBService
- Symantec Core LC
- ccEvtMgr
- SNDSrvc
- ccPwdSvc
- SWEEPSRV.SYS
- NOD32ControlCenter
- NOD32Service
- PCCPFW
- Tmntsrv
- AvxIni
- XCOMM
- ravmon8
- SmcService
- BlackICE
- PersFW
- McAfee Firewall
- OutpostFirewall
- NWService
- alerter
- sharedaccess
- NISUM
- NISSERV
- vsmon
- nwclnth
- nwclntg
- nwclnte
- nwclntf
- nwclntd
- nwclntc
- wuauserv
- navapsvc
- Symantec Core LC
- SAVScan
- kavsvc
- DefWatch
- Symantec AntiVirus Client
- NSCTOP
- Symantec Core LC
- SAVScan
- SAVFMSE
- ccEvtMgr
- McShield
- AlertManger
- McAfeeFramework
- AVExch32Service
- AVUPDService
- McTaskManager
- Network Associates Log Service
- Outbreak Manager
- MCVSRte
- mcupdmgr.exe
- AvgServ
- AvgCore
- AvgFsh
- awhost32
- Ahnlab task Scheduler
- MonSvcNT
- V3MonNT
- V3MonSvc
- FSDFWD
- navapsvc
- ccSetMgr
- VisNetic AntiVirus Plug-in

The trojan is also able to terminate different system services. If the following entries are present in the Registry, TR/Dldr.Bagle deletes them:

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"Symantec NetDriver Monitor"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"ccApp"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"NAV CfgWiz"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"SSC_UserPrompt"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"McAfee Guardian"=

[HKCU\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"McAfee.InstantUpdate.Monitor"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"APVXDWIN"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"KAV50"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"avg7_cc"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"avg7_emc"=

[HKLM\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\]
"Zone Labs Client"=

[HKLM\SOFTWARE\Symantec\]
%%

[HKLM\SOFTWARE\McAfee\]
%%

[HKLM\SOFTWARE\KasperskyLab\]
%%

[HKLM\SOFTWARE\Agnitum\]
%%

[HKLM\SOFTWARE\Panda Software\]
%%

[HKLM\SOFTWARE\Zone Labs\]

The trojan contains a list of URLs, from which it can download other components and store them into the Windows directory with different names. The URL list differs from one variant to another.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back