W32/MSNCorrupt

Analysis

• Detection included into Fortinet Virus Update March 14 2003
  Firmware 2.30 AV definition 4.056
  Firmware 2.36 AV definition 4.056
  
• Trojan is 32bit with a size of 69,632 bytes, and was coded using Visual Basic 6
  
• Trojan requires VB6 runtime library MSVBVM60.DLL on target system in order to be a threat
  
• When executed, Trojan may copy itself to the Windows folder as “SysOps.exe” and launch itself, and modify the registry in order to load at next Windows startup –
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
  "SysOps" = SysOps
  
• Trojan will wait for the infected user to initiate MSN Messenger – if this application is run, the Trojan virus may disable all incoming messages and send a notification message to the author of the virus as an alert that the Trojan is running on the victim’s computer
  
• Trojan has functionality to allow uploads to the victim’s machine and remotely execute the uploaded files as well as initiate a message flood attack against a contact listed in the MSN Messenger’s contact list of the infected user
  
• The Trojan attempts to disable Task Manager application via the registry however this is not functional in Windows 98 –
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\
  "DisableTaskMgr" = 01, 00, 00, 00
  
• Trojan contains the string “M$N Corruption” in its code