# MA-005.021999: MyCERT Advisory - IE0199.exe Trojan Horses

**Date:** 08 Feb 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-005.021999  
**Advisory ID:** MA-005.021999

---

1.0 Description
#### 1.1 Overview
This file (ie0199.exe) is a "denial of service attack" trojan. It was attached to a spoofed email address of Microsoft Corporation claims to be a free upgrade to the Microsoft Internet Explorer web browser. Microsoft denies sending the email.
You are advised not to run the program. This is because the program will actually modifies your system files flooded certain internet server with ICMP packets.
#### 1.2 Limitation
Only works on Windows platforms.
### 2.0 Technical Matters
#### 2.1 Installation
When running the program, it seem to be fail with a message indicating that it could not find a required dll files. However, upon close inspection, the program actually modified **c:\windows\system.ini.** and created two bogus system files named **sndvol.exe** and **mprexe.dll** Both can be found in **c:\windows\system**.
#### 2.2 Functionality
It also adds the **mprexe.dll** filename to the drivers entry in the [boot] section of **system.ini**. When the system is next restarted, the **mprexe.dll** is loaded and run. It adds several registry keys.
HKEY\_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial="00,00,00,00" HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\control\SessionManager\Known16DLLs\mprexe.dll="mprexe.dll" HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\control\SessionManager\Known16DLLs\SNDVOL.EXE="SNDVOL.EXE"
This key causes execution of **sndvol.exe** after logging into the internet. This is malicious code that continually half opens TCP connections on various ports to www.infotel.bg, ns.infotel.bg and www.btc.bg.
### 3.0 Possible Seps
#### 3.1 Detection
Open up your **regedit**, search for sndvol value in
HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\control\SessionManager\Known16DLLs\SNDVOL.EXE="SNDVOL.EXE"
if found then you have infected. Then, search you system directory for **sndvol.exe**.
#### 3.2 Reaction/Removal
You must delete Windows\System\sndvol.exe and **mprexe.dll**, check your task manager to find out if you have **sndvol.exe**currently running and terminate it and remove registry entries of
HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\control\SessionManager\Known16DLLs\mprexe.dll="mprexe.dll"
HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\control\SessionManager\Known16DLLs\SNDVOL.EXE="SNDVOL.EXE"
Lastly, remove only **mprexe.dll** from the drivers entry in the [boot] section of your **system.ini**.
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 **http://www.cert.org/advisories/CA-1999-02.html**
4.2 **http://vil.nai.com/vil/content/v\_10134.htm**
4.3 **http://www.europe.f-secure.com/v-descs/antibtc.shtml**