# MA-061.122003: MyCERT Alert - Circulation of An Email with Malicious Purpose

**Date:** 24 Dec 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-061.122003  
**Advisory ID:** MA-061.122003

---

Lately MyCERT has been receiving reports regarding the circulation of a suspicious email with misleading contents which requests recipients to click to a website attached in the email.
The content of the email is as below:
MyCERT's analysis of the email shows that once clicked on "this site" Five (5) malicious files believed to be Trojan will be dropped in the user's local drive.
NOTE: The malicious file is written in VBSscript which is not supported by Netscape browser. That is why if you clicked to the particular site using Netscape browser you will find a blank screen on your PC and no malicious files will be dropped in your local drive.
As for IE browser, it does support VBScript, however using IE version 6 and above will prompt a message upon clicking the site as below:
"An ActiveX control on this page might be unsafe to interact with other parts of the page. Do you want to allow this interaction?"
This shows that the script in the page wants to be executed with local user priviledge in the victim computer. If the user click "Yes", then the infection occurs and vice-versa.
The files that will be dropped in the victim's local drive are:
C:\2.exe
C:\Windows\msto32.dll
C:\Windows\svchost.exe
C:\Windows\system\wingua.exe
C:\Windows\sysini.ini
The presence of the above files can be detected by running TCPView and Process Viewer. These tools are available free for download in the Internet.
- **TCPView**
http://www.sysinternals.com/ntw2k/source/tcpview.shtml
- **Process Viewer**
http://www.xmlsp.com/pview/prcview.htm
The trojan also adds this following key to the registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Online Service= C:\\SYSTEM.EXE
The trojan runs by requesting to three foreign hosts:
xx.xx.xx:smtp
xx.xx.xx.xx:2990
xx.xx.xx.x: http
NOTE: xx.xx.xx:smtp - This may indicate the trojan may have an SMTP engine.
Our analysis shows the above Trojan may have some similarity with the Backdoor.Tofger, a keylogging Trojan, discovered on December 02 2003, UTC time.
Details on Backdoor.Tofger trojan is available at:
Sophos
http://www.sophos.com/virusinfo/analyses/trojtofgerb.html
Symantec
http://www.symantec.com/avcenter/venc/data/backdoor.tofger.html
The Vexira Anti-Virus had requested the trojan files from MyCERT for their analysis and attached below is their findings and virus description on the above files:
Vexira Anti-virus
http://support.centralcommand.com/cgi-bin/command.cfg/php/enduser/std\_adp.php?p\_faqid=591
With regards to this, MyCERT urges users who received such emails as below not to click on the mentioned site and we advise users to immediately delete any such emails received. You may forward to your respective ISP or to MyCERT if you receive any such emails for verification.
Please refer to our safe email practices at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
If any you has clicked on the site and if your machine has been infected with the above worm, then you may follow the steps below on removing the Trojan from your PC
1. In Process Viewer, kill svchost.exe which is run by
C:\Windows\svchost.exe, other svchost.exe's are valid windows application.
2. Delete these:
C:\2.exe
C:\Windows\msto32.dll
C:\Windows\svchost.exe
C:\Windows\system\wingua.exe
C:\Windows\sysini.ini
3. Delete registry. Make sure you back up your registry prior to editing your registry
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Online Service= C:\\SYSTEM.EXE
4. Reboot to make sure the system has been completely cleaned. To determine this run personal firewall, i.e. Sygate.
NOTE: This trojan is not detected spyware Tools such as Ad-aware, PestPatrol and Spybot.