Virus Alert: Trojan.Agent.AQTW

[Mindspank]

The reason I posted this is because Vista Machines, firewall or no, are HIGHLY vulnerable to this. It will affect alot of casual internet users "surfers"

Installs a default debugger that is injected into the execution sequence of a target application. If a threat is installed as a default debugger, it will be run every time a target application is attempted to be launched - either to mimic it and hide its own presence (e.g. an open port or a running process), or simply to be activated as often as possible.

Registers a 32-bit in-process server DLL.

Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Contains characteristics of an identified security risk.


The following files were created in the system:
1 %System%qnkfqvs.dll
2 %System%wkgszvx.exe Trojan-Downloader.Win32.Agent.aukz [Kaspersky Lab] Troj/Vundeb-A [Sophos]


Memory Modifications

There was a new process created in the system:

wkgszvx.exe %System%wkgszvx.exe 16,384 bytes

The following Registry Keys were created:
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{B05D9B24-659E-3715-B858-2D1B1CCD131A}
HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{B05D9B24-659E-3715-B858-2D1B1CCD131A}InprocServer32
HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}
HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}ProxyStubClsid
HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}ProxyStubClsid32
HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}TypeLib
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0win32
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0FLAGS
HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0HELPDIR
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionExplorerBrowser Helper Objects
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionExplorerBrowser Helper Objects{B05D9B24-659E-3715-B858-2D1B1CCD131A}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsiexplore.exe

The newly created Registry Values are:
[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{B05D9B24-659E-3715-B858-2D1B1CCD131A}InprocServer32]
(Default) = "[file and pathname of the sample #1]"
ThreadingModel = "Apartment"
[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{B05D9B24-659E-3715-B858-2D1B1CCD131A}]
(Default) = "D"
[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}TypeLib]
(Default) = "{1E5E364E-BAEE-37C2-BA28-2520937A874C}"
Version = "1.0"
[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}ProxyStubClsid32]
(Default) = "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}ProxyStubClsid]
(Default) = "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{8B70FAF 4-9E89-33B9-9CA7-6C4765B2CCF8}]
(Default) = "IDOMPeek"
[HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0win32]
(Default) = "[file and pathname of the sample #1]"
[HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0HELPDIR]
(Default) = "%System%"
[HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0FLAGS]
(Default) = "0"
[HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{1E5E364E-BAEE-37C2-BA28-2520937A874C}1.0]
(Default) = "LIB"
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionExplorerBrowser Helper Objects{B05D9B24-659E-3715-B858-2D1B1CCD131A}]
IExplore = 0x00000001
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsiexplore.exe]
Debugger = "%System%wkgszvx.exe"

so that wkgszvx.exe is injected into the execution sequence of iexplore.exe by being installed as its default debugger

Be warned, as of today there is a new drive by downloader (injects itself into your browser via websites).

I picked this one up today. Rather annoying. Opens like...Thirty iexplore.exe processes. I dont know what else it does though I do know that it completely axes internet explorer when you remove it. Its a simple fix though.

Open your registry editor and navigate to the key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

There will be an entry that says "Debugger". In that entry you will see the trojan file set as your debugger. Right click the key and select modify and delete the entire entry so its blank. That will restore your IE back to working order. If I find any other adverse affects, I will be sure to let you know.

Information gathered from:

http://www.threatexpert.com/report.a...435103713cb32f

[Blaaaaaaaah]

lmao@your edit.

Lucky I don't have Vista o_o

[Ivramire]

noobish question:-


I assume it doesn't affect Firefox?

[viasta]

this happens once to me only when I opened AIM, then it stopped happening and I don't use IE. dumb AIM..opens IE for "AIM Homepage". It just happens once you open IE I think

[JokerX]

Yes...Quite.....Luck for those who dont have this

[Mindspank]

Im not too sure if it affects XP or not. All I know is that I have both OS's (I dualboot) and was on windows vista at the time of infection, WITH a 3rd party firewall enabled AND spybot S&D immunization, though I dont think spybot would stop it.

[Shader]

I heard about this a couple of weeks or so ago. I don't use IE anymore because of problems it had for me months ago. Firefox just works better in my opinion. I E wouldn't load all websites I visited. T.T

I still need better Firewalls. *sniff* I'm worried for my computer.

[Ralath]

I think I used to have something similar to this on my Windows XP.

It would open Internet Explorer non-stop for like... 5 minutes and I had to keep closing windows... =.=

[Yosei]

Good thing I'm not much of a browser o: I only go to a few websites.

[iDerrick]

So this won't affect firefox right?