1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. Web Attack: W32.Clampi Download Attempt

Web Attack: W32.Clampi Download Attempt

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects a connection to a remote server which may download further updates or threats on the target computer.

Additional Information

Trojan.Clampi is a Trojan horse that connects to a remote server and may download further updates or other threats on to the compromised computer.

When the Trojan is executed, it creates the following files:

* %UserProfile%\Administrator\Local Settings\Temp\[ORIGINAL FILE NAME].exe
* %System%\regscan.exe



It then creates the following registry entries:

* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"GID" = "[8 NUMBERS]"
* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"GatesList" = "63 72 69 74 69 63 61 6C 66 61 63 74 6F 72 2E 63 63 00 2F 63 67 69 2D 62 69 6E 2F 63 69 74 79 2E 63 67 69 00 61 6E 61 6D 61 6C 69 74 79 2E 69 6E 66 6F 00 2F 63 67 69 2D 62 69 6E 2F 62 61 6E 67 2E 63 67 69 00 77 69 72 65 64 78 2E 69 6E 00 2F 63 67 69 2D 62 69 6E 2F 64 62 2E 63 67 69 00"
* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"KeyM" = "94 6B EE BC FF A5 BB 8B 5E 68 2A A5 8F BF 24 F5 7A 63 B7 9C BB DB 14 D5 1F AE B0 57 34 02 59 6F C6 38 9C 7E BD 8F 82 02 9F 36 AB 3F 0C 6C B9 4C C3 98 7E E6 77 0A CC 53 20 6F 6B 5B EC 83 A8 9E 34 C1 9E 9C 73 93 05 01 F3 3D D2 DA 79 ED 63 00 04 25 CB 82 FC 87 3D 89 E1 86 79 79 8C 67 A8 43 5C BC 65 26 66 5E B1 8A C5 51 95 E0 24 B8 7F F5 1A 1C 20 83 DD B7 44 E6 E7 66 B3 5D 88 A7 85 C8 2B A4 58 4E 18 85 A2 9D D3 16 D5 89 E6 51 4B 70 90 C9 F3 82 69 13 F1 09 ED 7C 30 86 2A 16 4A 4C A4 06 FA F9 78 C4 7D 72 93 FC 64 D7 48 C5 FB 83 A2 44 0A 98 77 BE CD 4B FE A8 69 A2 16 F2 73 C5 F1 44 FF 11 38 3E AF 5F 3F 87 05 61 61 FC FF 22 BE 00 D5 46 67 A0 BA CE 65 A5 C7 32 03 93 11 96 62 7E EB 0B 5D 9D 9A 92 1B 41 10 8C 2C 9B 09 A5 11 84 EB 91 CA 34 18 0E 92 2D 85 C7 6B 02 B0 EF"
* HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\"KeyE" = "00 01 00 01"


The Trojan also creates the following registry entry, so that it starts when Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Regscan" = "C:\WINDOWS\system32\regscan.exe"

Affected

  • Windows 2000
  • Windows 95
  • Windows 98
  • Windows Me
  • Windows NT
  • Windows Server 2003
  • Windows Vista
  • Windows XP

Response

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
4. Delete any values added to the registry.
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube