McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

ALS/Dwgun.a takes advantage of the automated loading of FAS files in AutoCAD to start itself. It may undefine some default commands in AutoCAD.

The trojan will write itself to the following folders in the program directory of AutoCAD and the Application Data folder:

• %Documents and Settings%\Application Data\Autodesk\AutoCAD 2007\R17.0\enu\Support
• %Program Files%\AutoCAD 2007\Drv
• %Program Files%\AutoCAD 2007\Fonts
• %Program Files%\AutoCAD 2007\Help
• %Program Files%\AutoCAD 2007\Support\Color
• %Program Files%\AutoCAD 2007\Support

It will drop a %SYSTEM%\dwgrun.bat file that will copy %WINDOWS%\winsys.ini and %WINDOWS%\winfas.ini to the user's Application Data folder as acad.sys and acad.fas and set the hidden attribute of these files.

The following registry entry is created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwgrun: "%SYSTEM%\dwgrun.bat"

(where %Documents and Settings% is the user's document and settings folder e.g. C:\Documents and Settings\username, %Program Files% is the program files folder e.g. C:\Program Files, %SYSTEM% is the Windows system folder e.g. C:\Windows\system32, %WINDOWS% is the Windows installtion folder e.g. C:\Windows)

Note: The trojan is programmed under an unkown and specific version of AutoCAD and running it on other versions of AutoCAD may not produce all behaviours.

Symptoms

• Presence of previously mentioned files

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

 

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

ALS/Dwgun.a takes advantage of the automated loading of FAS files in AutoCAD to start itself. It may undefine some default commands in AutoCAD.

The trojan will write itself to the following folders in the program directory of AutoCAD and the Application Data folder:

• %Documents and Settings%\Application Data\Autodesk\AutoCAD 2007\R17.0\enu\Support
• %Program Files%\AutoCAD 2007\Drv
• %Program Files%\AutoCAD 2007\Fonts
• %Program Files%\AutoCAD 2007\Help
• %Program Files%\AutoCAD 2007\Support\Color
• %Program Files%\AutoCAD 2007\Support

It will drop a %SYSTEM%\dwgrun.bat file that will copy %WINDOWS%\winsys.ini and %WINDOWS%\winfas.ini to the user's Application Data folder as acad.sys and acad.fas and set the hidden attribute of these files.

The following registry entry is created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwgrun: "%SYSTEM%\dwgrun.bat"

(where %Documents and Settings% is the user's document and settings folder e.g. C:\Documents and Settings\username, %Program Files% is the program files folder e.g. C:\Program Files, %SYSTEM% is the Windows system folder e.g. C:\Windows\system32, %WINDOWS% is the Windows installtion folder e.g. C:\Windows)

Note: The trojan is programmed under an unkown and specific version of AutoCAD and running it on other versions of AutoCAD may not produce all behaviours.

Symptoms

Symptoms -

• Presence of previously mentioned files

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

 

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A