Avira Virus Lab

TR/Agent.14606177

  • Name
    TR/Agent.14606177
  • Date discovered
    Dec 17, 2015
  • Type
    Malware
  • Impact
    Medium 
  • Reported Infections
    Low 
  • Operating System
    Windows
  • VDF version
    7.12.36.120 (2015-12-15 05:35)

Stay safe from all these threats with Avira Free Antivirus.

Avira Free Antivirus Download Free

The term 'TR' denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.

  • VDF
    7.12.36.120 (2015-12-15 05:35)
  • Aliases
    Avast: Win32:Malware-gen
    AVG: Generic14_c.AMGR
    Dr. Web: Trojan.KeyLogger.36972
    Trend Micro: PAK_Crypt
    Kaspersky Lab: HEUR:Trojan.Win32.Generic
    ESET: Win32/Packed.Themida application
  • Files
    The following files are changed:
    • %temporary internet files%\Content.IE5\index.dat
    • %USERPROFILE%\Cookies\index.dat
    • %USERPROFILE%\Local Settings\History\History.IE5\index.dat
    • %SYSDIR%\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
    • %SYSDIR%\CatRoot2\edb.chk
    • %SYSDIR%\wbem\Logs\wbemcore.log
    • %WINDIR%\Prefetch\WMIADAP.EXE-2DF425B2.pf
    • %WINDIR%\SoftwareDistribution\DataStore\DataStore.edb
    • %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.chk
    • %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.log
    The following files are deleted:
    • %TEMPDIR%\1.tmp
    • %TEMPDIR%\2.tmp
    • %TEMPDIR%\3.tmp
    • %TEMPDIR%\plugin.zip
    • %TEMPDIR%\mymacro.zip
    • %WINDIR%\SoftwareDistribution\DataStore\Logs\tmp.edb
    The following files are created:
    • %TEMPDIR%\1.tmp
    • %TEMPDIR%\2.tmp
    • %TEMPDIR%\3.tmp
    • %TEMPDIR%\plugin.zip
    • %TEMPDIR%\mymacro.zip
    • %APPDATA%\mymacro\qdisp.dll
    • %TEMPDIR%\5e64.tmp
    • %APPDATA%\qmacro\shield\SD000.dat
    • %APPDATA%\qmacro\shield\SD001.dat
    • %APPDATA%\qmacro\shield\SD002.dat
    • %APPDATA%\qmacro\shield\SD003.dat
    • %APPDATA%\qmacro\shield\SD004.dat
    • %APPDATA%\qmacro\shield\Shield.ini
  • Injections
    • %SYSDIR%\cmd.exe
    • %SYSDIR%\ipconfig.exe
    • %DISKDRIVE%\hips\loader.exe
    • {<-%SYSDIR%\DINPUT8.dll}
    • \SystemRoot\System32\smss.exe{<-%SYSDIR%\DINPUT8.dll}
    • \??\%SYSDIR%\csrss.exe{<-%SYSDIR%\DINPUT8.dll}
    • \??\%SYSDIR%\winlogon.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\services.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\lsass.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\VMware\VMware Tools\vmacthlp.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\svchost.exe{<-%SYSDIR%\DINPUT8.dll}
    • %WINDIR%\System32\svchost.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\spoolsv.exe{<-%SYSDIR%\DINPUT8.dll}
    • %WINDIR%\Explorer.EXE{<-%SYSDIR%\DINPUT8.dll}
    • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\FileZilla Server\FileZilla Server.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\Java\jre6\bin\jqs.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\VMware\VMware Tools\vmtoolsd.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\wuauclt.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\wbem\wmiprvse.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\VMware\VMware Tools\VMwareTray.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\Adobe\Reader 9.0\Reader\Reader_sl.exe{<-%SYSDIR%\DINPUT8.dll}
    • %PROGRAM FILES%\WinPcap\rpcapd.exe{<-%SYSDIR%\DINPUT8.dll}
    • %WINDIR%\System32\alg.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\wscntfy.exe{<-%SYSDIR%\DINPUT8.dll}
    • \\?\%SYSDIR%\WBEM\WMIADAP.EXE{<-%SYSDIR%\DINPUT8.dll}
    • %DISKDRIVE%\hips\vhsnz.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\cmd.exe{<-%SYSDIR%\DINPUT8.dll}
    • %SYSDIR%\ipconfig.exe{<-%SYSDIR%\DINPUT8.dll}
    • %DISKDRIVE%\hips\loader.exe{<-%SYSDIR%\DINPUT8.dll}
    • \\?\%SYSDIR%\WBEM\WMIADAP.EXE
  • Registry
    The following registry entries are added:
    • HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings ("JITDebug": dword:00000000)
    • HKEY_CLASSES_ROOT\QMDispatch.QMVBSRoutine (@: "QMDispatch.QMVBSRoutine")
    • HKEY_CLASSES_ROOT\CLSID\{241D7F03-9232-4024-8373-149860BE27C0} (@: "QMDispatch.QMVBSRoutine")
    • HKEY_CLASSES_ROOT\QMDispatch.QMVBSRoutine\CLSID (@: "{241D7F03-9232-4024-8373-149860BE27C0}")
    • HKEY_CLASSES_ROOT\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID (@: "QMDispatch.QMVBSRoutine")
    • HKEY_CLASSES_ROOT\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32 (@: "%APPDATA%\mymacro\qdisp.dll"; "ThreadingModel": "Apartment")
    • HKEY_CLASSES_ROOT\QMDispatch.QMRoutine (@: "QMDispatch.QMRoutine")
    • HKEY_CLASSES_ROOT\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049} (@: "QMDispatch.QMRoutine")
    • HKEY_CLASSES_ROOT\QMDispatch.QMRoutine\CLSID (@: "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}")
    • HKEY_CLASSES_ROOT\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID (@: "QMDispatch.QMRoutine")
    • HKEY_CLASSES_ROOT\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32 (@: "%APPDATA%\mymacro\qdisp.dll"; "ThreadingModel": "Apartment")
    • HKEY_CLASSES_ROOT\QMDispatch.QMLibrary (@: "QMDispatch.QMLibrary")
    • HKEY_CLASSES_ROOT\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B} (@: "QMDispatch.QMLibrary")
    • HKEY_CLASSES_ROOT\QMDispatch.QMLibrary\CLSID (@: "{EBEB87A6-E151-4054-AB45-A6E094C5334B}")
    • HKEY_CLASSES_ROOT\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID (@: "QMDispatch.QMLibrary")
    • HKEY_CLASSES_ROOT\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32 (@: "%APPDATA%\mymacro\qdisp.dll"; "ThreadingModel": "Apartment")
    • HKEY_CLASSES_ROOT\MyMacro.MyGUIMacroControlServer (@: "MyMacro.MyGUIMacroControlServer")
    • HKEY_CLASSES_ROOT\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678} (@: "MyMacro.MyGUIMacroControlServer")
    • HKEY_CLASSES_ROOT\MyMacro.MyGUIMacroControlServer\CLSID (@: "{DACDED71-1201-4F76-9C30-BDA795A55678}")
    • HKEY_CLASSES_ROOT\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\ProgID (@: "MyMacro.MyGUIMacroControlServer")
    • HKEY_CLASSES_ROOT\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\InprocHandler32 (@: "ole32.dll")
    • HKEY_CLASSES_ROOT\CLSID\{DACDED71-1201-4F76-9C30-BDA795A55678}\LocalServer32 (@: "%FILE_PATH%")
    • HKEY_CLASSES_ROOT\QMPlugin.Sys (@: "QMPlugin.Sys")
    • HKEY_CLASSES_ROOT\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9} (@: "QMPlugin.Sys")
    • HKEY_CLASSES_ROOT\QMPlugin.Sys\CLSID (@: "{33414471-126E-4FC8-B430-1C6143484AA9}")
    • HKEY_CLASSES_ROOT\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\ProgID (@: "QMPlugin.Sys")
    • HKEY_CLASSES_ROOT\CLSID\{33414471-126E-4FC8-B430-1C6143484AA9}\InProcServer32 (@: "%DISKDRIVE%\xxx\plugin\SYS.dll"; "ThreadingModel": "Apartment")
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids ("AIFFFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithProgids ("AIFFFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithProgids ("AIFFFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids ("ASFFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids ("ASXFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids ("AUFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids ("avifile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids ("Paint.Picture": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css\OpenWithProgids ("CSSfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids ("Paint.Picture": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithProgids ("WordPad.Document.1": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dvr-ms\OpenWithProgids ("WMP.DVR-MSFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids ("emffile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids ("giffile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithProgids ("FirefoxHTML": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids ("FirefoxHTML": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids ("icofile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ivf\OpenWithProgids ("IVFfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids ("pjpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids ("jpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids ("jpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids ("jpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids ("m3ufile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithProgids ("midfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\OpenWithProgids ("midfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids ("mp3file": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithProgids ("mpegfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids ("pngfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithProgids ("midfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithProgids ("rtffile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithProgids ("FirefoxHTML": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithProgids ("AUFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids ("TIFImage.Document": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids ("TIFImage.Document": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids ("txtfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithProgids ("soundrec": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\OpenWithProgids ("WAXFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids ("wdpfile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithProgids ("ASFFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithProgids ("WMAFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids ("wmffile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids ("WMVFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\OpenWithProgids ("ASXFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithProgids ("WPLFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wri\OpenWithProgids ("wrifile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithProgids ("WVXFile": %hex values%)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids ("CompressedFolder": %hex values%)

Help make the web safer by sending us suspicious files/URLs to analyze

Submit your file/URL or Go to support.avira.com

Why submit a suspicious file?

If you encountered a suspicious file or website that’s not in our database, we’ll analyze it and determine whether it’s harmful. Our findings are then pushed out to our millions of users with their next virus database update. If you have Avira, you’ll get that update too. Don’t have Avira? Get it on our homepage.