Trojan:Win32/Alureon.BT is a trojan that may modify the system's security settings and may drop other malware.
The Alureon family is also known to change a system's DNS settings. The Domain Name System (DNS) is used (among other things) to map domain names to IP addresses - that is, to map human-readable domain names to machine-readable IP addresses. When a user attempts to visit a particular URL, a browser will use DNS servers to find the correct IP address of the requested domain. When a user is directed to a malicious server that is not part of the authoritative Domain Name System, an attacker can provide incorrect IP addresses at their choice to map to particular domain names, thus directing the user to possibly bogus or malicious sites without the affected user's knowledge.
For more information refer to the description for the Win32/Alureon
Trojan:Win32/Alureon.BT may be downloaded or dropped by other members of the Alureon family. It is usually installed or dropped in the Windows Temporary Files folder as the following:
To enable itself to run every time Windows starts, it creates the following registry entry:
Adds value: "wow64main.exe"
With data: "%TEMP%\wow64main.exe"
To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
It also checks if the following file exists:
If this file does not exist, Trojan:Win32/Alureon.BT creates the following registry entries:
Adds value: "itime"
With data: "<Current system time>"
Adds value: "affid2"
With data: "139"
Adds value: "subid2"
With data: "64"
Adds value: "ver"
With data: "1.0"
To subkey: HKLM\Software\UAC
Drops other malware
Trojan:Win32/Alureon.BT drops the following file:
Connects to remote addresses
Trojan:Win32/Alureon.BT connects to the following IP address:
Modifies system settings and services
Trojan:Win32/Alureon.BT changes the way the Windows Security Center service works:
- Disables antivirus notifications from the Windows Security Center:
Adds value: "AntiVirusDisableNotify"
With data: "0"
To subkey: HKLM\SOFTWARE\Microsoft\Security Center
- Stops the Windows Security Center service 'wscsvc' and ensures that it is disabled with the following commands:
net stop wscsvc
sc config wscsvc start= disabled
Analysis by Tim Liu