Trojan.XalNaga

SUMMARY

This is a Trojan horse program. Once executed, this program modifies the registry to disable the Find, Run, and ShutDown functions on the Start menu. It also hides the Windows desktop and displays a message about the human era ending prior to system login.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low
• Modifies Files: System registry
• Degrades Performance: Disables Find, Run, and Shutdown functions. Disables the Desktop by preventing it from displaying icons.

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

When it is run, this Trojan modifies the Windows registry, so that when the computer is restarted, the following occurs:

• During the Windows login, a message box titled:
  
  <<< Xal Naga was here >>>
  
  appears. The box contains the message:
  
  "The human era has come to an end, the new breed of humans will evolve right now !!! Behold and despair !!!"
  
  The only option is to click OK. When you do so, the message box disappears.
• When Windows does start, the Find, Run, and Shut Down commands on the Start menu are disabled.
• The Windows desktop does not appear, as it has been hidden by the modifications made to the Windows registry.

Norton AntiVirus (NAV) detects this Trojan in the Datkiller.exe file, which is placed by the Trojan in the root of drive C.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

To repair the damage done by this Trojan, you must edit the Windows registry and delete the file that was placed on the hard disk.

Edit the Registry
Please follow these steps to remove the registry entries made by the Trojan:

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.

1. Click Start, point to Programs, and click MS-DOS Prompt.
2. Type regedit and then press Enter.
3. Navigate to the following key:
   
   HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
   
4. Delete each of the following values from the right pane. Click Yes to confirm the deletion for each one:
   
   NoRun
   NoFind
   NoClose
   NoDesktop
   
5. Delete the following keys from the left pane. Click Yes to confirm the deletion for each one:
   
   HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerSoftware
   HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
   
6. In the left pane, scroll to the top of the column and select the HKEY_CURRENT_USER key.
7. Click Edit, and click Find.
8. In the Find what box, type the following and click Find next:
   
   xal naga
   
9. If either or both of the following values are found, then delete them. Click Yes to confirm the deletion for each one:
   
   LegalNoticeCaption
   LegalNoticeText
   
10. Press F3 to continue the search, deleting the second value when it is found.
11. Exit the Registry Editor, and then restart the computer.

Delete the Trojan file
Follow these steps to remove the file that was placed on the hard drive by the Trojan:

1. Click Start, point to Find, and click Files or Folders.
2. Type datkiller.exe in the Named box, and then click Find Now.
3. Delete the file if it is found.