Trojan.Win32.Xalnaga
Details
Trojan.Win32.Xalnaga.a
This is a Win32 Trojan horse. When run, it modifies the Registry keys listed below and exits. The resulting effect of the Trojan running is the fact that Windows stays mostly non-functional: all icons on Desktop are removed, so it is not possible to reboot the machine in the usual way, etc.
The Trojan has the “copyright” string:
Tyrant-28881 {T-28881} virus
The affected registry keys are:
Key1:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDesktop = 1
Key2:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Winlogon
NoRun = 1
NoFind = 1
NoClose = 1
Key3:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools = 1
Key4:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon
LegalNoticeCaption = <<< Xal Naga was here >>>
LegalNoticeText = The human era has come to an end, the new breed of humans will evolve right now !!! Behold and despair !!!
The results are:
all icons are removed from Desktop (key1)
the “Start” menu items are removed: Run, Find, Shut Down (key2)
standard Registry editors under WinNT are disabled(key3)
message box displayed on logon: (key4)
Because of a bug in the Trojan, Key3 is written to the Registry in an incorrect form, and this action doesn’t function - it is possible to run Regedit and repair affected keys.
Repair: set these keys to ‘0′ or delete them.
Regedit.exe run: select Start\Programs\Windows Explorer, then browse for Regedit.exe and run it.
Related Posts