TROJ_KILLWIN.AS

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

• %User Profile%\Internet Explorer\brndlog.txt
• %User Temp%\DD_DEP~1.TXT
• %User Temp%\DD_DOT~2.TXT
• %User Temp%\DD_DOT~1.TXT
• %User Temp%\DD_DOT~3.TXT
• %User Temp%\DD_MSX~1.TXT
• %User Temp%\DD_NET~2.TXT
• %User Temp%\DD_NET~1.TXT
• %User Temp%\DD_NET~3.TXT
• %User Temp%\DD_NET~4.TXT
• %User Temp%\DD343F~1.TXT
• %User Temp%\DD_RGB~1.TXT
• %User Temp%\DD_VCR~2.TXT
• %User Temp%\DD_VCR~1.TXT
• %User Temp%\DD_WCF~2.TXT
• %User Temp%\DD_WCF~1.TXT
• %User Temp%\dd_WIC.txt
• %User Temp%\dd_XPS.txt
• %User Temp%\MICROS~1.TXT
• %User Temp%\MICROS~2.TXT
• %User Temp%\MICROS~3.TXT
• %User Temp%\UXEVEN~1.TXT
• %Application Data%\Microsoft\WALLPA~1.BMP
• %Temporary Internet Files%\Content.IE5\09RWHJQN\BOX02_~1.GIF
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\BOX04_~1.GIF
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\BOX08_~1.GIF
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\HEADER~1.GIF
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\BACKGR~1.GIF
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\BOX06_~1.GIF
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\FOOTER~1.GIF
• %User Profile%\Templates\winword.doc
• %User Profile%\Templates\winword2.doc
• %User Profile%\Templates\powerpnt.ppt
• %User Temp%\MICROS~1.HTM
• %User Temp%\MICROS~2.HTM
• %User Profile%\Templates\sndrec.wav
• %User Profile%\Templates\excel.xls
• %User Profile%\Templates\excel4.xls

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.mp3 = "winword.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.wma = "excel.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.ppt = "iexplore.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.avi = "notepad.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.jpg = "rawfile "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.mpeg = ".dll "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.mpg = ".mid "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.html = "wmplayer.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.htm = "wmplayer.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.wmv = "dvixfile "

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.swf = ".avi "

This report is generated via an automated analysis system.