TR/Drop.Auto.284172 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Drop.Auto.284172
Date discovered:	08/07/2008
Type:	Trojan
Subtype:	Dropper
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low
Static file:	No
IVDF version:	7.00.05.62 - Tue, 08 Jul 2008 08:15 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: W32.SillyFDC
   • Mcafee: Generic Downloader.x
   • Sophos: W32/AutoIt-I
   • Panda: Trj/Autoit.CJ
   • Grisoft: Worm/Autoit.BFQ
   • Eset: Win32/Autoit.CT
   • Bitdefender: Trojan.Autoit.TU

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads files
   • Drops files
   • Registry modification

Files It creates the following directory:
   • %PROGRAM FILES%\Common Files\Microsoft Shared\HTMLView

– %PROGRAM FILES%\Common Files\Microsoft Shared\HTMLView\htmlsupport%number%.exe Furthermore it gets executed after it was fully created.
– %PROGRAM FILES%\Common Files\Microsoft Shared\HTMLView\htmlview.exe
– %PROGRAM FILES%\Common Files\Microsoft Shared\HTMLView\sobsoftex.dll
– %PROGRAM FILES%\Common Files\Microsoft Shared\HTMLView\win.exe

It tries to download some files:

– The locations are the following:
   • http://rosk.ic.cz/htmlsupport/**********
   • http://rosk.ic.cz/htmlsupport/**********
   • http://rosk.ic.cz/htmlsupport/**********

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "HTMLSupport"="%HOME%\Application Data\Microsoft\Internet Explorer\htmlsupport%number%.exe"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX

See a brief description here.

Description inserted by Petre Galan on Thu, 02 Jul 2009 19:44 (GMT+1)
Description updated by Petre Galan on Fri, 10 Jul 2009 15:45 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back