Select local site

| Japanese | Simplified Chinese | Traditional Chinese (Hong Kong) | Traditional Chinese (Taiwan)

F-Secure Malware Information Pages: Trojan-Downloader:W32/Streedom.A
[Summary] | [Disinfection] | [Detailed Description] | [Detection]

Name : Trojan-Downloader:W32/Streedom.A
Alias:Trojan:Win32/Agent.gen!C, Generic.Malware.Sdld!.84025C35, Mal/Basine-A, Trj/Downloader.LLN
Size:4,045 Bytes
Type:Trojan-Downloader
Category:Malware
Platform:W32
Date of Discovery:March 29, 2007
Radar

Summary
Trojan-Downloader:W32/Streedom.A is a file embedded within Trojan:W97M/Streedom.A.

Trojan-Downloader:W32/Streedom.A downloads and runs a file from a website.
Back to the Top

Disinfection

Automatic Disinfection

Usually viruses infecting boot and executable files are automatically disinfected by F-Secure Anti-Virus (FSAV). In some cases, when automatic disinfection is not possible due to file corruption or overwriting virus, a user can select disinfection action by themself to make FSAV rename or delete an infected file. In some special cases, it is recommended to use specific disinfection tools provided by F-Secure. They can be downloaded from our web or ftp sites:

http://www.f-secure.com/download-purchase/tools.shtml

ftp://ftp.f-secure.com/anti-virus/tools/

F-Secure Anti-Virus can be purchased from our web shop or from our authorized distributors. A trial version F-Secure Anti-Virus, limited to 30 days, can be downloaded from our website:

http://www.f-secure.com/download-purchase/

All the latest versions of FSAV can download anti-virus database updates automatically. However, these updates can be also downloaded and installed manually from our web or ftp sites:

http://www.f-secure.com/download-purchase/updates.shtml

Manual Disinfection

It is not recommended to manually disinfect files and boot sectors from viruses as it can cause damage a system and make it unbootable.

System Restore issue and file viruses

If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that, System Restore feature of these operating systems might save an infected file into the special folder and copies it back to a hard drive every time it has been renamed or deleted by F-Secure Anti-Virus or by a user. Instructions on how to disable System Restore feature are here:

Windows ME:

http://www.europe.f-secure.com/v-descs/sfc_dis.shtml

Windows XP:

http://www.europe.f-secure.com/v-descs/sfc_dis1.shtml

It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in case of any crash or incompatibility issue occurs in the future.
Back to the Top

Detailed Description
Trojan-Downloader:W32/Streedom.A arrives to the system as an embedded binary executable file from within a malicious .RTF file, which is detected as Trojan:W97M/Streedom.A.

Upon execution of the embedded file, it will drop a copy of itself in the following path and file name:

  • %sysdir%\linkuyy.exe

To enable automatic execution upon boot up, Trojan-Downloader:W32/Streedom.A adds the following auto start registry entry:

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    linkyuu = %sysdir%\linkuyy.exe

Trojan-Downloader:W32/Streedom.A creates this file and then deletes it again:

  • c:\ali.html

Note: this is a hard coded string

Trojan-Downloader:W32/Streedom.A uses the default Internet Browser installed on the system to download Trojan-Dropper:W32/Streedom.A. In order to do this, it creates a process for the browser and then injects itself. Afterwards, it will remotely trigger a thread that contains the main payload, which is the download routine.

Trojan-Downloader:W32/Streedom.A will only start downloading if an Internet Connection is available. Internet availability is checked by establishing a connection to the following site:

  • http://www.google.com

If an Internet connection is unavailable, it will infinitely try establishing a connection every 10000 ms or 10 seconds.

Here is the URL from where it downloads Trojan-Dropper:W32/Streedom.A:

  • http://www.nightcrossings.com/g[REMOVED]/inv.exe

The downloaded file is saved and executed in the following path and filename:

  • %windir%\tnc.exe

The creator of this malware uses message boxes to debug this program.

This message box for instance, shows up when it fails to launch a process of the default browser:



Here are more of the other message boxes:











This malware has been packed with FSG 2.0.
Back to the Top

Detection

F-Secure Anti-Virus detects this malware with the following updates:

[FSAV_Database_Version]

Version = 2007-03-29_02.
Back to the Top



F-Secure Corporation

Last Modified: March 29, 2007