arrow_back
search
close

TROJ_VB.JGT

October 08, 2012
 Analysis by: Christopher Daniel So
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Trojan deletes itself after execution.

  TECHNICAL DETAILS

File Size:

593,920 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

31 Aug 2010

Installation

This Trojan drops the following copies of itself into the affected system:

  • %Program Files%\zxdqyqokxvaa.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This Trojan drops the following files:

  • %System Root%\Documents and Settings\All Users\Start Menu\Programs\Startup\zxdqyqokxvaa.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan does the following:

  • It drops copies of itself in random folders.

It deletes itself after execution.

  SOLUTION

Minimum Scan Engine:

8.900

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Scan your computer with your Trend Micro product and note files detected as TROJ_VB.JGT

Step 3

Restart in Safe Mode

[ Learn More ]


Did this description help? Tell us how we did.