TROJ_MONKIF.F

This Trojan may arrive bundled with malware packages as a malware component. It may be dropped by other malware. However, as of this writing, the said sites are inaccessible.

It is injected into all running processes to remain memory resident.

It opens a hidden Internet Explorer window. It requires its main component to successfully perform its intended routine.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be dropped by other malware.

However, as of this writing, the said sites are inaccessible.

Installation

This Trojan is injected into all running processes to remain memory resident.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Local\UIEI

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• ACAAS.exe
• ACAEGMr.exe
• ACAIS.exe
• ACALS.exe
• ACASP.exe
• AFMain.exe
• AGIDSUI.exe
• ALMon.exe
• ALsvc.exe
• APVXDWIN.EXE
• AVGIDSAgent.exe
• AVGIDSMonitor.exe
• AVGIDSWatcher.exe
• AhnSD.exe
• AhnSDsv.exe
• AluSchedulerSvc.exe
• ApVxdWin.exe
• CAGlobal.exe
• CAGlobalLight.exe
• CAPPActiveProtection.exe
• CCSVCHST.EXE
• CClaw.exe
• CounterSpy.exe
• EMLPROUI.EXE
• EMLPROXY.EXE
• FAMEH32.exe
• FCH32.EXE
• FPAVServer.exe
• FProtTray.exe
• FSM32.EXE
• FSMA32.EXE
• FSMB32.exe
• HFACSvc.exe
• HrRes.exe
• IFace.exe
• ISWSVC.exe
• ITMRTSVC.exe
• K7EmlPxy.exe
• K7FWSrvc.exe
• K7PSSrvc.exe
• K7RTScan.exe
• K7SysMon.exe
• K7SysTry.exe
• K7TSMngr.exe
• K7TSecurity.exe
• MSASCui.exe
• MSProxy.ahn
• McNASvc.exe
• McProxy.exe
• McSACore.exe
• Mcshield.exe
• MpfSrv.exe
• MsMpEng.exe
• Nbrowser.exe
• Nip.exe
• Njeeves.exe
• Nsesvc.exe
• Nvcoas.exe
• ONLINENT.EXE
• ONLNSVC.EXE
• OPSSVC.EXE
• OcHealthMon.exe
• PAVSRV51.EXE
• PPCtlPriv.exe
• PSANHost.exe
• PSHost.exe
• PSUNMain.exe
• PXAgent.exe
• PXConsole.exe
• PavBckPT.exe
• PavFnSvr.exe
• PavPrSrv.exe
• PslmSvc.exe
• QOELoader.exe
• QUHLPSVC.EXE
• RavMon.exe
• RavTask.exe
• RsTray.exe
• SAVAdminService.exe
• SBCSSvc.exe
• SBCSTray.exe
• SCANMSG.EXE
• SCANWSCS.EXE
• SavService.exe
• SfCtlCom.exe
• SpIDerAgent.exe
• SpIDerMI.exe
• TMBMSRV.exe
• TRAYSSER.EXE
• TSCFCommander.exe
• TSCFPlatformCOMSvr.exe
• TmPfw.exe
• TmProxy.exe
• UPSCHD.EXE
• UfNai.exe
• UfSeAgnt.exe
• UfUpdUi.exe
• UmxAgent.exe
• UmxCfg.exe
• UmxFwHlp.exe
• UmxPol.exe
• WEBPROXY.EXE
• WinSSUI.exe
• Zanda.exe
• Zlh.exe
• acs.exe
• ashDisp.exe
• ashMaiSv.exe
• ashServ.exe
• ashWebSv.exe
• aswUpdSv.exe
• avesvc.exe
• avgam.exe
• avgamsvr.exe
• avgas.exe
• avgcc.exe
• avgcsrvx.exe
• avgemc.exe
• avgfws8.exe
• avgnsx.exe
• avgrsx.exe
• avgtray.exe
• avgupd.exe
• avgupsvc.exe
• avgwdsvc.exe
• avgwsvc.exe
• avp.exe
• avpmapp.exe
• avwebgrd.exe
• caavguiscan.exe
• capfasem.exe
• cappactiveprotection.exe
• casc.exe
• casecuritycenter.exe
• cavrid.exe
• ccSvcHst.exe
• ccschedulersvc.exe
• cctray.exe
• drwebscd.exe
• egui.exe
• ekrn.exe
• elogsvc.exe
• forsp.exe
• fsaua.exe
• fsav32.exe
• fsavgui.exe
• fsdfwd.exe
• fsgk32.exe
• fsgk32st.exe
• fsguidll.exe
• fspc.exe
• fsqh.exe
• fssm32.exe
• fsus.exe
• guard.exe
• guardxkickoff.exe
• guardxservice.exe
• guardxup.exe
• hcontain.exe
• hpcsvc.exe
• hsvcmod.exe
• isafe.exe
• livesrv.exe
• mcagent.exe
• mcmscsvc.exe
• mcshell.exe
• mcsysmon.exe
• mcupdmgr.exe
• mcvsmap.exe
• mcvsshld.exe
• mdmcls32.exe
• msfwsvc.exe
• msksrver.exe
• npcsvc32.exe
• npfsvc32.exe
• npfuser.exe
• nprosec.exe
• nuaa.exe
• nvcsched.exe
• nvoy.exe
• op_mon.exe
• prevx.exe
• psksvc.exe
• qhfw.exe
• rsnetsvr.exe
• seccenter.exe
• spiderml.exe
• spidernt.exe
• spidersgate.exe
• spiderui.exe
• svcprs32.exe
• symlcsvc.exe
• vba32ldr.exe
• vbcmserv.exe
• vbsystry.exe
• vetmsg.exe
• virCatch.exe
• virusutilities.exe
• vrfwsock.exe
• vrfwsvc.exe
• vrmonnt.exe
• vrmonsvc.exe
• vrrepair.exe
• vrscan.exe
• vsmon.exe
• vsserv.exe
• winss.exe
• winssnotify.exe
• xcommsvr.exe
• zlclient.exe

Other Details

This Trojan opens a hidden Internet Explorer window.

It requires its main component to successfully perform its intended routine.

It attempts to access the following websites to download files, which are possibly malicious:

• http://www.pixmediaz.com/photo/{random}.php?{random}
• http://www.mediablitzk.com/photo/{random}.php?{random}