Trojan:Win32/Cinmus.I

Trojan:Win32/Cinmus.I is the driver component of Trojan:Win32/Cinmus trojans. It displays pop-up advertisements and may download files from a remote site.

Trojan:Win32/Cinmus.I usually arrives in a system as a dropped file of another Trojan:Win32/Cinmus trojan. It is typically dropped as the following:
<system folder>\drivers\acpidisk.sys

 

Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.

 

To register the dropped file as a system service, the dropper creates the following registry entries:

 

Adds value: "DisplayName"
With data: "acpidisk"
Adds value: "ErrorControl"
With data: "1"
Adds value: "ImagePath"
With data: "%sysdir%\drivers\acpidisk.sys"
Adds value: "Start"
With data: "2"
To subkey: HKLM\SYSTEM\CurrentControlSet\Services\acpidisk

 

The above registry modifications ensure that Trojan:Win32/Cinmus.I is started as the system service "acpidisk" every time Windows starts.

When the "acpidisk" service is started, it drops a DLL in the System folder as "winlib .dll" and injects it into the "winlogon.exe" process. Note that there is a space character between "winlib" and ".dll". The dropped DLL file may download files and display pop-up advertisements from the website "chnsystem.com".

 

After it has been successfully injected into the "winlogon.exe" process, the dropped DLL is removed from the system.