[Baw17]

Lamorte,
Malware Type : Backdoor
Alias : TR/Crypt.XPACK.Gen [Avira]
System Affected : Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Risk Rating : Low

When Backdoor.Agent.fzs is executed, it performs the following activities:

It drops the below malicious files:

%System%\drivers\loads_lamonax.exe
%System%\ftpdll.dll
%Documents and Settings%\Administrator\Local Settings\Application Data\loads_lamo.exe
%Documents and Settings%\Administrator\ftpdll.dll

It also create/modify the following registry entries:

ntuser = "%System%\drivers\loads_lamonax.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

autoload = "%Documents and Settings%\Administrator\Local Settings\Application Data\loads_lamo.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

UIHost = "logonui.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

ImagePath = "%System%\drivers\loads_lamonax.exe"
HKLM\SYSTEM\ControlSet001\Services\Schedule

ImagePath = "%System%\drivers\loads_lamonax.exe"
HKLM\SYSTEM\CurrentControlSet\Services\Schedule