 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 02:17 Titlul subiectului: Trojan.Crypt.DE |
 |
|
Trojan.Crypt.DE
( Virtool:Win32/Obfuscator.AP, Trojan.MulDrop.15722, PWS-OnlineGames.av trojan, Win32/TrojanDropper.Agent.NJR )
Raspandire : mediu
Dauna : mediu
Size: 120-130 kbytes
Descoperit : 2008 May 19
SYMPTOMS:
-the presence of the files tavo.exe and tavo0.dll in %WINDIR%/system32 folder;
-the presence of a file named tt.exe, 1.exe or 2.exe in %WINDIR% folder;
-the presence of a startup registry key:
HKCU/Software/Microsoft/Windows/CurrentVersion/Run
tava="%WINDIR%/system32/tavo.exe
TECHNICAL DESCRIPTION:
This malware is a dropper which creates a file named tt.exe, 1.exe or 2.exe in %WINDIR% folder. The dropped file is detected as Packer.Malware.NSAnti.AO. After executing this file, the dropper deletes itself.
The dropped file will create a registry key in order to make sure it will be executed after every reboot and will drop two files, tavo.exe and tavo0.dll in %WINDIR%/system32 folder. After this, it will hijack explorer.exe and will inject one of it's component, tavo0.dll, in each running process.
The purpose of these components is to steal online games accounts used to acces http://tw.gamania.com/. |
|
FAQ 
Mesaje private 
