Content

Skintrim.gen

Type
Trojan
SubType
Generic
Discovery Date
08/05/2008
Length
varies
Minimum DAT
5354 (08/05/2008)
Updated DAT
5434 (11/14/2008)
Minimum Engine
5.2.00
Description Added
08/05/2008
Description Modified
08/15/2008 8:47 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

Upon execution, the trojan installs itself into the

%ProgramFiles%\MailSkinner\

directory as

MailSkinner.exe, OESkinner.dll, and OLSkinner.dll

and installs in the

%windows%\system32\

the following files

msegcompid.dll, msclock32.jpg and axsetup.dll

The following Registry key(s) is/are added to hook system startup:

  • HKEY_CURRENT_USER\Software\epk_extr
  • HKEY_CURRENT_USER\Software\mc
  • HKEY_CURRENT_USER\Software\exts
  • HKEY_CURRENT_USER\Software\exts\{8E09CB72-3143-4414-A1C2-63E9C0438472}
  • HKEY_CURRENT_USER\Software\MailSkinner
  • HKEY_CURRENT_USER\Software\Microsoft\Installer
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\Features
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\
    96FF640DA68D6C24EAF73B276C0844D6
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\
    589C136F0E6FCEA4FAC5EFBABA79F5A0
  • HKEY_CLASSES_ROOT\CLSID\{180B4EE9-1795-4429-9651-F17A6515726D}
  • HKEY_CLASSES_ROOT\Interface\{0A089E22-5736-4092-B3F8-3F0D5F345482}
  • HKEY_CLASSES_ROOT\OutlookAddin.Addin
  • HKEY_CLASSES_ROOT\OutlookAddin.Addin.1
  • HKEY_CLASSES_ROOT\TypeLib\{5BAD7FAE-81F0-4439-8C1A-3E8907998047}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\
    OutlookAddin.Addin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
    UpgradeCodes\589C136F0E6FCEA4FAC5EFBABA79F5A0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Uninstall\{D046FF69-D86A-42C6-AE7F-B372C680446D}

In addition, after installing itself, the trojan will try to contact

 http://www.security-udpater.com

to check if there is any new version.

Symptoms

Once running on the victim machine, OESkinner.dll will be hooked to all running processes, and axsetup.dll will be hooked to iexplore.exe.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This detection is for a family of trojans which download and execute arbitary files.

Characteristics

Characteristics -

Upon execution, the trojan installs itself into the

%ProgramFiles%\MailSkinner\

directory as

MailSkinner.exe, OESkinner.dll, and OLSkinner.dll

and installs in the

%windows%\system32\

the following files

msegcompid.dll, msclock32.jpg and axsetup.dll

The following Registry key(s) is/are added to hook system startup:

  • HKEY_CURRENT_USER\Software\epk_extr
  • HKEY_CURRENT_USER\Software\mc
  • HKEY_CURRENT_USER\Software\exts
  • HKEY_CURRENT_USER\Software\exts\{8E09CB72-3143-4414-A1C2-63E9C0438472}
  • HKEY_CURRENT_USER\Software\MailSkinner
  • HKEY_CURRENT_USER\Software\Microsoft\Installer
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\Features
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\
    96FF640DA68D6C24EAF73B276C0844D6
  • HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\
    589C136F0E6FCEA4FAC5EFBABA79F5A0
  • HKEY_CLASSES_ROOT\CLSID\{180B4EE9-1795-4429-9651-F17A6515726D}
  • HKEY_CLASSES_ROOT\Interface\{0A089E22-5736-4092-B3F8-3F0D5F345482}
  • HKEY_CLASSES_ROOT\OutlookAddin.Addin
  • HKEY_CLASSES_ROOT\OutlookAddin.Addin.1
  • HKEY_CLASSES_ROOT\TypeLib\{5BAD7FAE-81F0-4439-8C1A-3E8907998047}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\
    OutlookAddin.Addin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
    UpgradeCodes\589C136F0E6FCEA4FAC5EFBABA79F5A0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Uninstall\{D046FF69-D86A-42C6-AE7F-B372C680446D}

In addition, after installing itself, the trojan will try to contact

 http://www.security-udpater.com

to check if there is any new version.

Symptoms

Symptoms -

Once running on the victim machine, OESkinner.dll will be hooked to all running processes, and axsetup.dll will be hooked to iexplore.exe.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A