Trojan:Win32/Wintrim.gen!A

Trojan:Win32/Wintrim.gen!A is a generic detection for variants of the Win32/Wintrim trojan family.

Variants of Win32/Wintrim have been known to be downloaded by variants of Win32/Skintrim family.

 

When executed, Win32/Wintrim adds a registry entry to the following subkey to execute itself at each Windows start:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
Wintrim variants may inject a DLL into all user mode processes as part of its Payload (see below for additional detail).

Win32/Wintrim variants can obscure their presence on an affected machine by hiding their processes, registry keys and files. Wintrim does this by injecting a DLL component into all running user mode processes and hooking the following APIs exported by the system library ntdll.dll:
 
NTEnumerateKey          
NTEnumerateValueKey     
NTQueryDirectoryFile    
NTQuerySystemInformation 

 

Win32/Wintrim variants can post information about the infected machine, such as connection settings, installed software, OS version and configuration information, to a remote website.

 

Win32/Wintrim variants may add their own entry to the Trusted Providers list by altering the following registry entries:
 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\
 
Downloads and Executes Arbitrary Files

Win32/Wintrim variants may download and execute arbitrary files. Wintrim also has the ability to update itself using this mechanism.

 

Win32/Wintrim variants may display various forms of advertising include pop-up and banner ads.