TROJ_OBVOD.FKZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\{random}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %System Root%\Documents and Settings\All Users\Application Data\{random}.exe.b
• %System Root%\Documents and Settings\All Users\Application Data\{random}.exe_.b

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
DisableScriptDebuggerIE = "yes"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Error Dlg Displayed On Every Error = "no"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ScheduleHKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Services\Schedule
AtTaskMaxHours = "48"