TROJ_DLOADER.FVQ
Windows 98, ME, NT, 2000, XP, Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
TECHNICAL DETAILS
73,728 bytes
PE
Yes
03 Jul 2009
Installation
This Trojan drops and executes the following files:
- %System%\systemsp.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
Other System Modifications
This Trojan adds the following registry entries:
HKEY_CURRENT_USER\Software\spro\
Init
Version = "1.0.0.1"
Download Routine
This Trojan accesses the following websites to download files:
- http://up1.sidepro.co.kr/spro.exe
- http://up1.sidepro.co.kr/version_up.txt
- http://up1.sidepro.co.kr/sproinit.exe
- http://up1.sidepro.co.kr/Process.txt
- http://up1.sidepro.co.kr/systemsp.exe
It saves the files it downloads using the following names:
- %ProgramFiles%\SPro\sproinit.exe
- %System%\systemsp.exe
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
SOLUTION
8.900
6.242.04
03 Jul 2009
7/3/2009 12:00:00 AM
Step 1
Scan your computer with your Trend Micro product and note files detected as TROJ_DLOADER.FVQ
Step 2
Terminate a malware/grayware process
*Note: If the detected process is not displayed in theWindows Task Manager, continue doing the next steps.
- systemsp.exe
Step 3
Search and delete these files
%ProgramFiles%\SPro\sproinit.exe
Step 4
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software
- spro
- spro
Step 5
Scan your computer with your Trend Micro product to delete files detected as TROJ_DLOADER.FVQ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.