TROJ_KILSRV.EUIQ

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It may be downloaded from the following remote sites:

• {BLOCKED}.{BLOCKED}.196.130

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\gb_service.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %System%\GB_CATCHME.EXE - a copy of GMER Catchme tool

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\AGBR5
ImagePath = "%System%\gb_service.exe"

NOTES:

This malware uninstalls a software called GbPlugin, a software that protects Brazilian bank customers when performing online banking transactions, from the affected system. It does the said routine by utilizing the GMER Catchme tool %System%\GB_CATCHME.EXE to delete GbPlugin related files and registries from a system. As a result, an infected user is left susceptible to banking malware that targets Brazilian banks.

(Note: %System% is the Windows system folder, which is usually C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)