Trojan.KillFiles.9062

Added to the Dr.Web virus database: 2012-03-06

Virus description added: 2012-03-27

Technical Information

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\MSBuild\ctfmon.exe

Executes the following:

<SYSTEM32>\cmd.exe /c <Current directory>\a.bat
<SYSTEM32>\sfc.exe /purgecache
<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\MSWINSCK.OCX

Modifies file system :

Creates the following files:

<Current directory>\a.bat
%PROGRAM_FILES%\MSBuild\ctfmon.exe
<SYSTEM32>\MSWINSCK.OCX

Deletes the following files:

<SYSTEM32>\dllcache\agt0804.dll
<SYSTEM32>\dllcache\agt0816.dll
<SYSTEM32>\dllcache\agt0c0a.dll
<SYSTEM32>\dllcache\agt0419.dll
<SYSTEM32>\dllcache\agt041d.dll
<SYSTEM32>\dllcache\agt041f.dll
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\alrsvc.dll
<SYSTEM32>\dllcache\amstream.dll
<SYSTEM32>\dllcache\agtctl15.tlb
<SYSTEM32>\dllcache\agtintl.dll
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\agt040d.dll
<SYSTEM32>\dllcache\agt040e.dll
<SYSTEM32>\dllcache\agt0410.dll
<SYSTEM32>\dllcache\agt0409.dll
<SYSTEM32>\dllcache\agt040b.dll
<SYSTEM32>\dllcache\agt040c.dll
<SYSTEM32>\dllcache\agt0414.dll
<SYSTEM32>\dllcache\agt0415.dll
<SYSTEM32>\dllcache\agt0416.dll
<SYSTEM32>\dllcache\agt0411.dll
<SYSTEM32>\dllcache\agt0412.dll
<SYSTEM32>\dllcache\agt0413.dll
<SYSTEM32>\dllcache\ansi.sys
<SYSTEM32>\dllcache\aspperf.dll
<SYSTEM32>\dllcache\asptxn.dll
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\asctrls.ocx
<SYSTEM32>\dllcache\asferror.dll
<SYSTEM32>\dllcache\asp51.dll
<SYSTEM32>\dllcache\asyncmac.sys
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\atkctrs.dll
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\asycfilt.dll
<SYSTEM32>\dllcache\apphelp.dll
<SYSTEM32>\dllcache\apphelp.sdb
<SYSTEM32>\dllcache\apph_sp.sdb
<SYSTEM32>\dllcache\apcups.dll
<SYSTEM32>\dllcache\appconf.dll
<SYSTEM32>\dllcache\append.exe
<SYSTEM32>\dllcache\appwiz.cpl
<SYSTEM32>\dllcache\aqueue.dll
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\appmgmts.dll
<SYSTEM32>\dllcache\appmgr.dll
<SYSTEM32>\dllcache\apps.chm
<SYSTEM32>\dllcache\agt0408.dll
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\dllcache\actxprxy.dll
<SYSTEM32>\dllcache\acxtrnal.dll
<SYSTEM32>\dllcache\acspecfc.dll
<SYSTEM32>\dllcache\activeds.dll
<SYSTEM32>\dllcache\activeds.tlb
<SYSTEM32>\dllcache\admparse.dll
<SYSTEM32>\dllcache\admwprox.dll
<SYSTEM32>\dllcache\admxprox.dll
<SYSTEM32>\dllcache\admexs.dll
<SYSTEM32>\dllcache\admin.dll
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\aaaamon.dll
<SYSTEM32>\dllcache\access.cpl
<SYSTEM32>\dllcache\acctres.dll
<SYSTEM32>\dllcache\12520437.cpx
<SYSTEM32>\dllcache\12520850.cpx
<SYSTEM32>\dllcache\6to4svc.dll
<SYSTEM32>\dllcache\acledit.dll
<SYSTEM32>\dllcache\aclua.dll
<SYSTEM32>\dllcache\aclui.dll
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\dllcache\acgenral.dll
<SYSTEM32>\dllcache\aclayers.dll
<SYSTEM32>\dllcache\adptif.dll
<SYSTEM32>\dllcache\agentmpx.dll
<SYSTEM32>\dllcache\agentpsh.dll
<SYSTEM32>\dllcache\agentsr.dll
<SYSTEM32>\dllcache\agentctl.dll
<SYSTEM32>\dllcache\agentdp2.dll
<SYSTEM32>\dllcache\agentdpv.dll
<SYSTEM32>\dllcache\agt0405.dll
<SYSTEM32>\dllcache\agt0406.dll
<SYSTEM32>\dllcache\agt0407.dll
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\dllcache\agt0401.dll
<SYSTEM32>\dllcache\agt0404.dll
<SYSTEM32>\dllcache\adsldpc.dll
<SYSTEM32>\dllcache\adsmsext.dll
<SYSTEM32>\dllcache\adsnds.dll
<SYSTEM32>\dllcache\adrot.dll
<SYSTEM32>\dllcache\adsiis51.dll
<SYSTEM32>\dllcache\adsldp.dll
<SYSTEM32>\dllcache\advpack.dll
<SYSTEM32>\dllcache\afd.sys
<SYSTEM32>\dllcache\agentanm.dll
<SYSTEM32>\dllcache\adsnt.dll
<SYSTEM32>\dllcache\adsnw.dll
<SYSTEM32>\dllcache\advapi32.dll

Deletes itself.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial