Full description

Virus:	TR/Agent.33792.R
Date discovered:	04/01/2010
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low
Static file:	Yes
File size:	33.792 Bytes
MD5 checksum:	51ab5c878892a48bd8ff4561bfd0bb2b
IVDF version:	7.10.02.116 - Monday, January 4, 2010

General Aliases:
   • Panda: W32/Koobface.HG.worm
   • Eset: Win32/Koobface.NBH
   • Bitdefender: Win32.Worm.Koobface.APD

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
• %WINDIR%\pp14.exe

It deletes the initially executed copy of itself.

It deletes the following file:
• %WINDIR%\dxxdv34567.bat

The following files are created:

– %WINDIR%\dxxdv34567.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.
– %WINDIR%\fdgg34353edfgdfdf

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• "pp"="%WINDIR%\pp14.exe"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

说明添加者： Petre Galan 打开 2010年3月17日星期三
说明更新者： Petre Galan 打开 2010年3月17日星期三

反馈 . . . .

我的帐户