TROJ_COINMINER.AUSX
Trojan:Win32/Adylkuzz.A (Microsoft); RDN/Generic.grp (McAfee); Trojan.Adylkuzz (Symantec); Trojan.Win32.Miner.azd (Kaspersky); Troj/Miner-CC (Sophos); Trojan.Win32.Generic!BT (Sunbelt); Found Win32/DH{NkIggRIkIiU} (AVG)
Windows
Threat Type:
Trojan
Destructiveness:
No
Encrypted:
In the wild::
Yes
OVERVIEW
TECHNICAL DETAILS
Instalación
Crea las carpetas siguientes:
- %Program Files%\Hardware Driver Management
(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).
)Rutina de infiltración
Infiltra los archivos siguientes:
- %Temp%\s1ts._Miner_.log
- %Temp%\s1ts.1_Miner_.log
- %Temp%\s1ts.2_Miner_.log
- %Temp%\s1ts.3_Miner_.log
- %Temp%\s1ts.4_Miner_.log
- %Temp%\s1ts.5_Miner_.log
- %Temp%\s1ts.6_Miner_.log
- %Temp%\s1ts.7_Miner_.log
- %Temp%\s1ts.8_Miner_.log
- %Temp%\s1ts.9_Miner_.log
- %Temp%\s1ts.a_Miner_.log
- %Temp%\s1ts.b_Miner_.log
- %Temp%\s1ts.c_Miner_.log
- %Temp%\s1ts.d_Miner_.log
- %Temp%\s1ts.e_Miner_.log
- %Temp%\s1ts.f_Miner_.log
- %Temp%\s1ts.g_Miner_.log
- %Temp%\s1ts.h_Miner_.log
- %Temp%\s1ts.i_Miner_.log
- %Temp%\s1ts.j_Miner_.log
- %Temp%\s1ts.k_Miner_.log
- %Temp%\s1ts.l_Miner_.log
- %Temp%\s1ts.m_Miner_.log
- %Temp%\s1ts.n_Miner_.log
- %Temp%\s1ts.o_Miner_.log
- %Temp%\s1ts.p_Miner_.log
- %Temp%\s1ts.q_Miner_.log
- %Temp%\s1ts.r_Miner_.log
- %Temp%\s1ts.s_Miner_.log
- %Temp%\s1ts.t_Miner_.log
- %Temp%\s1ts.u_Miner_.log
- %Temp%\s1ts.v_Miner_.log
- %Temp%\s1ts.10_Miner_.log
- %Temp%\s1ts.11_Miner_.log
- %Temp%\s1ts.12_Miner_.log
- %Temp%\s1ts.13_Miner_.log
- %Temp%\s1ts.14_Miner_.log
- %Temp%\s1ts.15_Miner_.log
- %Temp%\s1ts.16_Miner_.log
- %Temp%\s1ts.17_Miner_.log
- %Temp%\s1ts.18_Miner_.log
- %Temp%\s1ts.19_Miner_.log
- %Temp%\s1ts.1a_Miner_.log
- %Temp%\s1ts.1b_Miner_.log
- %Temp%\s1ts.1c_Miner_.log
- %Temp%\s1ts.1d_Miner_.log
- %Temp%\s1ts.1e_Miner_.log
- %Temp%\s1ts.1f_Miner_.log
- %Temp%\s1ts.1g_Miner_.log
- %Temp%\s1ts.1h_Miner_.log
- %Temp%\s1ts.1i_Miner_.log
- %Temp%\s1ts.1j_Miner_.log
- %Temp%\s1ts.1k_Miner_.log
- %Temp%\s1ts.1l_Miner_.log
- %Temp%\s1ts.1m_Miner_.log
- %Temp%\s1ts.1n_Miner_.log
- %Temp%\s1ts.1o_Miner_.log
- %Temp%\s1ts.1p_Miner_.log
- %Temp%\s1ts.1q_Miner_.log
- %Temp%\s1ts.1r_Miner_.log
- %Temp%\s1ts.1s_Miner_.log
- %Temp%\s1ts.1t_Miner_.log
- %Temp%\s1ts.1u_Miner_.log
- %Temp%\s1ts.1v_Miner_.log
- %Temp%\s1ts.20_Miner_.log
- %Temp%\s1ts.21_Miner_.log
- %Temp%\s1ts.22_Miner_.log
- %Temp%\s1ts.23_Miner_.log
- %Temp%\s1ts.24_Miner_.log
- %Temp%\s1ts.25_Miner_.log
- %Temp%\s1ts.26_Miner_.log
- %Temp%\s1ts.27_Miner_.log
- %Temp%\s1ts.28_Miner_.log
- %Temp%\s1ts.29_Miner_.log
- %Temp%\s1ts.2a_Miner_.log
- %Temp%\s1ts.2b_Miner_.log
- %Temp%\s1ts.2c_Miner_.log
- %Temp%\s1ts.2d_Miner_.log
- %Temp%\s1ts.2e_Miner_.log
- %Temp%\s1ts.2f_Miner_.log
- %Temp%\s1ts.2g_Miner_.log
- %Temp%\s1ts.2h_Miner_.log
- %Temp%\s1ts.2i_Miner_.log
- %Temp%\s1ts.2j_Miner_.log
- %Temp%\s1ts.2k_Miner_.log
- %Temp%\s1ts.2l_Miner_.log
- %Temp%\s1ts.2m_Miner_.log
- %Temp%\s1ts.2n_Miner_.log
- %Temp%\s1ts.2o_Miner_.log
- %Temp%\s1ts.2p_Miner_.log
- %Temp%\s1ts.2q_Miner_.log
- %Temp%\s1ts.2r_Miner_.log
- %Temp%\s1ts.2s_Miner_.log
- %Temp%\s1ts.2t_Miner_.log
- %Temp%\s1ts.2u_Miner_.log
- %Temp%\s1ts.2v_Miner_.log
- %Temp%\s1ts.30_Miner_.log
- %Temp%\s1ts.31_Miner_.log
- %Temp%\s1ts.32_Miner_.log
- %Temp%\s1ts.33_Miner_.log
- %Temp%\s1ts.34_Miner_.log
- %Temp%\s1ts.35_Miner_.log
- %Temp%\s1ts.36_Miner_.log
- %Temp%\s1ts.37_Miner_.log
- %Temp%\s1ts.38_Miner_.log
- %Temp%\s1ts.39_Miner_.log
- %Temp%\s1ts.3a_Miner_.log
- %Temp%\s1ts.3b_Miner_.log
- %Temp%\s1ts.3c_Miner_.log
- %Temp%\s1ts.3d_Miner_.log
- %Temp%\s1ts.3e_Miner_.log
- %Temp%\s1ts.3f_Miner_.log
- %Temp%\s1ts.3g_Miner_.log
- %Temp%\s1ts.3h_Miner_.log
- %Temp%\s1ts.3i_Miner_.log
- %Temp%\s1ts.3j_Miner_.log
- %Temp%\s1ts.3k_Miner_.log
- %Temp%\s1ts.3l_Miner_.log
- %Temp%\s1ts.3m_Miner_.log
- %Temp%\s1ts.3n_Miner_.log
- %Temp%\s1ts.3o_Miner_.log
- %Temp%\s1ts.3p_Miner_.log
- %Temp%\s1ts.3q_Miner_.log
- %Temp%\s1ts.3r_Miner_.log
- %Temp%\s1ts.3s_Miner_.log
- %Temp%\s1ts.3t_Miner_.log
- %Temp%\s1ts.3u_Miner_.log
- %Temp%\s1ts.3v_Miner_.log
- %Temp%\s1ts.40_Miner_.log
- %Temp%\s1ts.41_Miner_.log
- %Temp%\s1ts.42_Miner_.log
- %Temp%\s1ts.43_Miner_.log
- %Temp%\s1ts.44_Miner_.log
- %Temp%\s1ts.45_Miner_.log
- %Temp%\s1ts.46_Miner_.log
- %Temp%\s1ts.47_Miner_.log
- %Temp%\s1ts.48_Miner_.log
- %Temp%\s1ts.49_Miner_.log
- %Temp%\s1ts.4a_Miner_.log
- %Temp%\s1ts.4b_Miner_.log
- %Temp%\s1ts.4c_Miner_.log
- %Temp%\s1ts.4d_Miner_.log
- %Temp%\s1ts.4e_Miner_.log
- %Temp%\s1ts.4f_Miner_.log
- %Temp%\s1ts.4g_Miner_.log
- %Temp%\s1ts.4h_Miner_.log
- %Temp%\s1ts.4i_Miner_.log
- %Temp%\s1ts.4j_Miner_.log
- %Temp%\s1ts.4k_Miner_.log
- %Temp%\s1ts.4l_Miner_.log
- %Temp%\s1ts.4m_Miner_.log
- %Temp%\s1ts.4n_Miner_.log
- %Temp%\s1ts.4o_Miner_.log
- %Temp%\s1ts.4p_Miner_.log
- %Temp%\s1ts.4q_Miner_.log
- %Temp%\s1ts.4r_Miner_.log
- %Temp%\s1ts.4s_Miner_.log
- %Temp%\s1ts.4t_Miner_.log
- %Temp%\s1ts.4u_Miner_.log
- %Temp%\s1ts.4v_Miner_.log
- %Temp%\s1ts.50_Miner_.log
- %Temp%\s1ts.51_Miner_.log
- %Temp%\s1ts.52_Miner_.log
- %Temp%\s1ts.53_Miner_.log
- %Temp%\s1ts.54_Miner_.log
- %Temp%\s1ts.55_Miner_.log
- %Temp%\s1ts.56_Miner_.log
- %Temp%\s1ts.57_Miner_.log
- %Temp%\s1ts.58_Miner_.log
- %Temp%\s1ts.59_Miner_.log
- %Temp%\s1ts.5a_Miner_.log
- %Temp%\s1ts.5b_Miner_.log
- %Temp%\s1ts.5c_Miner_.log
- %Temp%\s1ts.5d_Miner_.log
- %Temp%\s1ts.5e_Miner_.log
- %Temp%\s1ts.5f_Miner_.log
- %Temp%\s1ts.5g_Miner_.log
- %Temp%\s1ts.5h_Miner_.log
- %Temp%\s1ts.5i_Miner_.log
- %Temp%\s1ts.5j_Miner_.log
- %Temp%\s1ts.5k_Miner_.log
(Nota: %Temp% es la carpeta de archivos temporales de Windows, que suele estar en C:\Windows\Temp o C:\WINNT\Temp).
)
SOLUTION
Step 1
Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.
Step 2
Buscar y eliminar estos archivos
- %Temp%\s1ts._Miner_.log
- %Temp%\s1ts.1_Miner_.log
- %Temp%\s1ts.2_Miner_.log
- %Temp%\s1ts.3_Miner_.log
- %Temp%\s1ts.4_Miner_.log
- %Temp%\s1ts.5_Miner_.log
- %Temp%\s1ts.6_Miner_.log
- %Temp%\s1ts.7_Miner_.log
- %Temp%\s1ts.8_Miner_.log
- %Temp%\s1ts.9_Miner_.log
- %Temp%\s1ts.a_Miner_.log
- %Temp%\s1ts.b_Miner_.log
- %Temp%\s1ts.c_Miner_.log
- %Temp%\s1ts.d_Miner_.log
- %Temp%\s1ts.e_Miner_.log
- %Temp%\s1ts.f_Miner_.log
- %Temp%\s1ts.g_Miner_.log
- %Temp%\s1ts.h_Miner_.log
- %Temp%\s1ts.i_Miner_.log
- %Temp%\s1ts.j_Miner_.log
- %Temp%\s1ts.k_Miner_.log
- %Temp%\s1ts.l_Miner_.log
- %Temp%\s1ts.m_Miner_.log
- %Temp%\s1ts.n_Miner_.log
- %Temp%\s1ts.o_Miner_.log
- %Temp%\s1ts.p_Miner_.log
- %Temp%\s1ts.q_Miner_.log
- %Temp%\s1ts.r_Miner_.log
- %Temp%\s1ts.s_Miner_.log
- %Temp%\s1ts.t_Miner_.log
- %Temp%\s1ts.u_Miner_.log
- %Temp%\s1ts.v_Miner_.log
- %Temp%\s1ts.10_Miner_.log
- %Temp%\s1ts.11_Miner_.log
- %Temp%\s1ts.12_Miner_.log
- %Temp%\s1ts.13_Miner_.log
- %Temp%\s1ts.14_Miner_.log
- %Temp%\s1ts.15_Miner_.log
- %Temp%\s1ts.16_Miner_.log
- %Temp%\s1ts.17_Miner_.log
- %Temp%\s1ts.18_Miner_.log
- %Temp%\s1ts.19_Miner_.log
- %Temp%\s1ts.1a_Miner_.log
- %Temp%\s1ts.1b_Miner_.log
- %Temp%\s1ts.1c_Miner_.log
- %Temp%\s1ts.1d_Miner_.log
- %Temp%\s1ts.1e_Miner_.log
- %Temp%\s1ts.1f_Miner_.log
- %Temp%\s1ts.1g_Miner_.log
- %Temp%\s1ts.1h_Miner_.log
- %Temp%\s1ts.1i_Miner_.log
- %Temp%\s1ts.1j_Miner_.log
- %Temp%\s1ts.1k_Miner_.log
- %Temp%\s1ts.1l_Miner_.log
- %Temp%\s1ts.1m_Miner_.log
- %Temp%\s1ts.1n_Miner_.log
- %Temp%\s1ts.1o_Miner_.log
- %Temp%\s1ts.1p_Miner_.log
- %Temp%\s1ts.1q_Miner_.log
- %Temp%\s1ts.1r_Miner_.log
- %Temp%\s1ts.1s_Miner_.log
- %Temp%\s1ts.1t_Miner_.log
- %Temp%\s1ts.1u_Miner_.log
- %Temp%\s1ts.1v_Miner_.log
- %Temp%\s1ts.20_Miner_.log
- %Temp%\s1ts.21_Miner_.log
- %Temp%\s1ts.22_Miner_.log
- %Temp%\s1ts.23_Miner_.log
- %Temp%\s1ts.24_Miner_.log
- %Temp%\s1ts.25_Miner_.log
- %Temp%\s1ts.26_Miner_.log
- %Temp%\s1ts.27_Miner_.log
- %Temp%\s1ts.28_Miner_.log
- %Temp%\s1ts.29_Miner_.log
- %Temp%\s1ts.2a_Miner_.log
- %Temp%\s1ts.2b_Miner_.log
- %Temp%\s1ts.2c_Miner_.log
- %Temp%\s1ts.2d_Miner_.log
- %Temp%\s1ts.2e_Miner_.log
- %Temp%\s1ts.2f_Miner_.log
- %Temp%\s1ts.2g_Miner_.log
- %Temp%\s1ts.2h_Miner_.log
- %Temp%\s1ts.2i_Miner_.log
- %Temp%\s1ts.2j_Miner_.log
- %Temp%\s1ts.2k_Miner_.log
- %Temp%\s1ts.2l_Miner_.log
- %Temp%\s1ts.2m_Miner_.log
- %Temp%\s1ts.2n_Miner_.log
- %Temp%\s1ts.2o_Miner_.log
- %Temp%\s1ts.2p_Miner_.log
- %Temp%\s1ts.2q_Miner_.log
- %Temp%\s1ts.2r_Miner_.log
- %Temp%\s1ts.2s_Miner_.log
- %Temp%\s1ts.2t_Miner_.log
- %Temp%\s1ts.2u_Miner_.log
- %Temp%\s1ts.2v_Miner_.log
- %Temp%\s1ts.30_Miner_.log
- %Temp%\s1ts.31_Miner_.log
- %Temp%\s1ts.32_Miner_.log
- %Temp%\s1ts.33_Miner_.log
- %Temp%\s1ts.34_Miner_.log
- %Temp%\s1ts.35_Miner_.log
- %Temp%\s1ts.36_Miner_.log
- %Temp%\s1ts.37_Miner_.log
- %Temp%\s1ts.38_Miner_.log
- %Temp%\s1ts.39_Miner_.log
- %Temp%\s1ts.3a_Miner_.log
- %Temp%\s1ts.3b_Miner_.log
- %Temp%\s1ts.3c_Miner_.log
- %Temp%\s1ts.3d_Miner_.log
- %Temp%\s1ts.3e_Miner_.log
- %Temp%\s1ts.3f_Miner_.log
- %Temp%\s1ts.3g_Miner_.log
- %Temp%\s1ts.3h_Miner_.log
- %Temp%\s1ts.3i_Miner_.log
- %Temp%\s1ts.3j_Miner_.log
- %Temp%\s1ts.3k_Miner_.log
- %Temp%\s1ts.3l_Miner_.log
- %Temp%\s1ts.3m_Miner_.log
- %Temp%\s1ts.3n_Miner_.log
- %Temp%\s1ts.3o_Miner_.log
- %Temp%\s1ts.3p_Miner_.log
- %Temp%\s1ts.3q_Miner_.log
- %Temp%\s1ts.3r_Miner_.log
- %Temp%\s1ts.3s_Miner_.log
- %Temp%\s1ts.3t_Miner_.log
- %Temp%\s1ts.3u_Miner_.log
- %Temp%\s1ts.3v_Miner_.log
- %Temp%\s1ts.40_Miner_.log
- %Temp%\s1ts.41_Miner_.log
- %Temp%\s1ts.42_Miner_.log
- %Temp%\s1ts.43_Miner_.log
- %Temp%\s1ts.44_Miner_.log
- %Temp%\s1ts.45_Miner_.log
- %Temp%\s1ts.46_Miner_.log
- %Temp%\s1ts.47_Miner_.log
- %Temp%\s1ts.48_Miner_.log
- %Temp%\s1ts.49_Miner_.log
- %Temp%\s1ts.4a_Miner_.log
- %Temp%\s1ts.4b_Miner_.log
- %Temp%\s1ts.4c_Miner_.log
- %Temp%\s1ts.4d_Miner_.log
- %Temp%\s1ts.4e_Miner_.log
- %Temp%\s1ts.4f_Miner_.log
- %Temp%\s1ts.4g_Miner_.log
- %Temp%\s1ts.4h_Miner_.log
- %Temp%\s1ts.4i_Miner_.log
- %Temp%\s1ts.4j_Miner_.log
- %Temp%\s1ts.4k_Miner_.log
- %Temp%\s1ts.4l_Miner_.log
- %Temp%\s1ts.4m_Miner_.log
- %Temp%\s1ts.4n_Miner_.log
- %Temp%\s1ts.4o_Miner_.log
- %Temp%\s1ts.4p_Miner_.log
- %Temp%\s1ts.4q_Miner_.log
- %Temp%\s1ts.4r_Miner_.log
- %Temp%\s1ts.4s_Miner_.log
- %Temp%\s1ts.4t_Miner_.log
- %Temp%\s1ts.4u_Miner_.log
- %Temp%\s1ts.4v_Miner_.log
- %Temp%\s1ts.50_Miner_.log
- %Temp%\s1ts.51_Miner_.log
- %Temp%\s1ts.52_Miner_.log
- %Temp%\s1ts.53_Miner_.log
- %Temp%\s1ts.54_Miner_.log
- %Temp%\s1ts.55_Miner_.log
- %Temp%\s1ts.56_Miner_.log
- %Temp%\s1ts.57_Miner_.log
- %Temp%\s1ts.58_Miner_.log
- %Temp%\s1ts.59_Miner_.log
- %Temp%\s1ts.5a_Miner_.log
- %Temp%\s1ts.5b_Miner_.log
- %Temp%\s1ts.5c_Miner_.log
- %Temp%\s1ts.5d_Miner_.log
- %Temp%\s1ts.5e_Miner_.log
- %Temp%\s1ts.5f_Miner_.log
- %Temp%\s1ts.5g_Miner_.log
- %Temp%\s1ts.5h_Miner_.log
- %Temp%\s1ts.5i_Miner_.log
- %Temp%\s1ts.5j_Miner_.log
- %Temp%\s1ts.5k_Miner_.log
Step 3
Buscar y eliminar esta carpeta
- %Program Files%\Hardware Driver Management
Step 4
Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como TROJ_COINMINER.AUSX En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.
Did this description help? Tell us how we did.