Resolve for RKProc-Fam and Stinx

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.

Troj/RKProc-Fam is a family of kernel-mode driver rootkits.

Members of Troj/RKProc-Fam are capable of hiding information about certain running processes, providing stealthing by patching the kernel service descriptor table.

Troj/Stinx-E is a backdoor Trojan for the Windows platform.

Troj/Stinx-E connects to one of several IP addresses and runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run Troj/Stinx-E copies itself to $sys$drv.exe.

Troj/Stinx-E can be instructed to delete, execute, and download and execute files. Troj/Stinx-E is a backdoor Trojan for the Windows platform.

Troj/Stinx-E connects to one of several IP addresses and runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run Troj/Stinx-E copies itself to $sys$drv.exe.

Troj/Stinx-E can be instructed to delete, execute, and download and execute files.

Troj/Stinx-E will attempt to circumvent the Windows Firewall if it is present by adding itself to the list of allowed programs.

Troj/Stinx-E may be stealthed on an infected system by exploiting Sony DRM (Digital Rights Management) software.

Troj/Stinx-E creates a Mutex variable named "SonyEnabled".

Troj/Stinx-E may arrive as an email attachment wherein it is claimed that the attached file is a photograph to be published that requires approval.

Troj/Stinx-F is a backdoor Trojan for the Windows platform.

Troj/Stinx-F connects to one of several IP addresses and runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

Troj/Stinx-F can be instructed to delete, download and execute files.

Troj/Stinx-F will attempt to circumvent the Windows Firewall if it is present by adding itself to the list of allowed programs.

Troj/Stinx-F may be stealthed on an infected system by exploiting Sony DRM (Digital Rights Management) software.

Troj/Stinx-F may arrive as an email attachment wherein it is claimed that the attached file is a photograph to be published that requires approval. Troj/Stinx-F is a backdoor Trojan for the Windows platform.

Troj/Stinx-F connects to one of several IP addresses and runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When first run Troj/Stinx-F copies itself to $sys$xp.exe, and creates the following registry entry so it is automatically run when an infected computer starts:

HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun $sys$cmp $sys$xp.exe

HKCUSoftwareMicrosoftWindowsCurrentVersionRun $sys$cmp $sys$xp.exe

Troj/Stinx-F can be instructed to delete, and download and execute files.

Troj/Stinx-F will attempt to circumvent the Windows Firewall if it is present by adding itself to the list of allowed programs.

Troj/Stinx-F may be stealthed on an infected system by exploiting Sony DRM (Digital Rights Management) software.

Troj/Stinx-F may arrive as an email attachment wherein it is claimed that the attached file is a photograph to be published that requires approval.

Troj/RKProc-Fam and Troj/Stinx can be removed from Windows computers automatically with the following Resolve tools:

RKPRFGUI is a disinfector for standalone Windows computers. To use it you have to do the following: ￭ Open RKPRFGUI.com file from your desktop after downloading it. ￭ Click on the Start Scan Button. ￭ Wait for the process to complete.

RKPRFSFX.EXE is a self-extracting archive containing RKPRFCLI, a Resolve command line disinfector for use by system administrators on Windows networks.