Trojan.Siggen4.9367

Trojan.Siggen4.9367

Added to the Dr.Web virus database: 2012-07-05

Virus description added: 2012-07-26

Technical Information

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

Executes the following:

<SYSTEM32>\net.exe stop "McAfee.com McShield"
<SYSTEM32>\net1.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net.exe stop "McAfee WSC Integration"
<SYSTEM32>\net.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net1.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net.exe stop "IPSEC Services"
<SYSTEM32>\net1.exe stop "SyGateService"
<SYSTEM32>\net.exe stop "AVP Control Centre Service"
<SYSTEM32>\net1.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net.exe stop "SyGateService"
<SYSTEM32>\net.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net1.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net1.exe stop "Panda Antivirus"
<SYSTEM32>\net.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net1.exe stop "Trend ServerProtect"
<SYSTEM32>\net1.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "VSMON"
<SYSTEM32>\net.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "IPSEC Services"
<SYSTEM32>\net.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "ZONEALARM"
<SYSTEM32>\net1.exe stop "zlclient"
<SYSTEM32>\net1.exe stop "McAfee WSC Integration"
<SYSTEM32>\net.exe stop "VSMON"
<SYSTEM32>\net1.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "McAfee.com McShield"
<SYSTEM32>\net.exe stop "zlclient"
<SYSTEM32>\net1.exe stop "AVP Control Centre Service"
<SYSTEM32>\net.exe stop "ZONEALARM"
<SYSTEM32>\net1.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net1.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop "WyvernWorks Firewall"
<SYSTEM32>\net1.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "LOCKDOWN2000"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall Pro"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net1.exe stop "Blackice Defender"
<SYSTEM32>\net1.exe stop "F-Prot.exe"
<SYSTEM32>\net1.exe stop "Fprot.exe"
<SYSTEM32>\net.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop sharedaccess
<SYSTEM32>\net.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "F-Prot.exe"
<SYSTEM32>\net1.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "Blackice Defender"
<SYSTEM32>\net1.exe stop sharedaccess
<SYSTEM32>\net.exe stop "Fprot.exe"
<SYSTEM32>\net.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net1.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "Trend ServerProtect"
<SYSTEM32>\net1.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "Panda Antivirus"
<SYSTEM32>\net1.exe stop "LOCKDOWN2000"
<SYSTEM32>\net.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net1.exe stop "WyvernWorks Firewall"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\net.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall Pro"

Modifies file system :

Creates the following files:

Network activity:

UDP:

DNS ASK ir#.#hello.at

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial