..
Click anywhere to stop
Click anywhere to stop
Detect Date | 06/25/2005 |
Class | Trojan-Downloader |
Platform | Win32 |
Description |
This is a generic detection for a family of Trojan downloaders. These malicious programs will download a range of other malicious programs from the Internet to the victim machine. Programs from this family may create the following registry values: [HKLMSOFTWAREDR_S] [HKCUSOFTWAREDR_S] [HKLMSOFTWAREClassesdrs.nuID] [HKCUSOFTWAREClassesdrs.nuID] All programs in this family have an identical way of getting URLs from where they will download additional malicious programs. Every 30 minutes a program from this family will download a file from, for instance, http://www.adzhooter.com/DR_S/gSD.html. This file contains addresses which direct the Trojan to other sites where it can download additional malicious programs: |5|20050406|
ts|http://www.adzhooter.com/DR_S/bp/as_8_new.exe|1|bs_8_new.exe|1.0|1| adsh|http://www.adzhooter.com/DR_S/bp/afita.exe|2|afita.exe|1.2|1| sfitb|http://www.adzhooter.com/DR_S/bp/SYSsfita.dll|3|SYSsfita.dll|1.0|2 sfitb|| ezu|http://www.adzhooter.com/DR_S/bp/wzStub.exe|3|wzStub.exe|1.0|1| sfisb|http://www.adzhooter.com/DR_S/bp/ReplaceSearch.dll|3|ReplaceSearch sfisb|.dll|1.0|2| |
Find out the statistics of the threats spreading in your region |