Trojan.AVKill.6921

Added to the Dr.Web virus database: 2011-06-18

Virus description added: 2011-06-18

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '"<Full path to virus>" -a "%PROGRAM_FILES%\Internet Explorer\iexplore.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '3659899780' = '<Full path to virus>'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'

To complicate detection of its presence in the operating system,

blocks the following features:

Terminates or attempts to terminate

the following user processes:

Modifies file system :

Creates the following files:

%HOMEPATH%\Templates\ifm.exe
%HOMEPATH%\Templates\ygq.exe
%HOMEPATH%\Templates\ixl.exe
%TEMP%\qve.exe
%TEMP%\mhg.exe
%TEMP%\pop.exe
%ALLUSERSPROFILE%\Application Data\41u6e2v80wwx4u0113hs32ilj10b7ca4u47muc5n3kl5b
%TEMP%\41u6e2v80wwx4u0113hs32ilj10b7ca4u47muc5n3kl5b
%HOMEPATH%\Templates\41u6e2v80wwx4u0113hs32ilj10b7ca4u47muc5n3kl5b
%HOMEPATH%\Templates\cej.exe
%HOMEPATH%\Templates\ppd.exe
<LS_APPDATA>\41u6e2v80wwx4u0113hs32ilj10b7ca4u47muc5n3kl5b
<LS_APPDATA>\dwn.exe
<LS_APPDATA>\oml.exe
%ALLUSERSPROFILE%\Application Data\cem.exe
<LS_APPDATA>\coh.exe
<LS_APPDATA>\ckf.exe
<LS_APPDATA>\jct.exe
%ALLUSERSPROFILE%\Application Data\djm.exe
%TEMP%\sfq.exe
%TEMP%\krr.exe
%ALLUSERSPROFILE%\Application Data\swa.exe
%ALLUSERSPROFILE%\Application Data\iak.exe
%ALLUSERSPROFILE%\Application Data\fnu.exe

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: