Virus:W32/Gnil.A

Classification

W32/Fujacks.z, Mal/Behav-010, TROJ_DLOADER.KEX, Worm/Fujacks.z, Gnil.a, W32/Malware.LRP

Summary

Gnil.A has the ability to infect remote computers over a local network and attempts to download and install other malware to the system.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.

Technical Details

Gnil.A may arrive in the system as an executable with an icon that depicts an alien.

Sample screenshot:

Once the execution of Gnil.A has been initiated, it will drop the following files into the Windows System directory:

xrtnyo.exe - Loader of the .dll component
xrtnyo.dll - Contains most of the payload

It will delete the executed copy of itself with the help of a batch file created in the temporary folder:

~Lying!.bAt

Gnil.A injects its .DLL component to the following processes:

explorer.exe
services.exe
winlogon.exe

It terminates the following processes related to Viking and Fujacks variants:

c0nime.exe
iexpl0re.exe
FuckJacks.exe
Logo1_.exe
Logo_1.exe
nvscv32.exe
Rundl132.exe
spoclsv.exe
svch0st.exe

Note: String comparison is case sensitive.

It infects binary files of the following extension:

.exe
.scr

Moreover Gnil.A also infects script files with the following extension:

.asp
.css
.htm
.html
.js

It avoids infecting folders with the following strings:

ComPlus Applications
Common Files
Delphi
Internet Explorer
Messenger
Microsoft Frontpage
Movie Maker
NetMeeting
Online Services
Outlook Express
RECYCLER
System Volume Information
System32
WINNT
WinRAR
Windows
Windows Media Player
Windows NT

Note: String comparison is case sensitive. This is why most system files are still infected.

Gnil.A will append a code at the end of the script file to point to a malicious website:

https://www.lovesa.info/l[BLOCKED].gif

Note: As of this writing the site is no longer available

Gnil.A may also use Internet Explorer to download from the said site. It gets the location of Internet Explorer by querying the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

Or it may use the following hard coded path:

C:\Program Files\Internet Explorer\IEXPLORE.EXE

Aside from infecting binary and script files as a way to propagate, it can also spread via network shares using a combination of the following strings as username and passwords: