Trojan.DownLoader4.23958

Added to the Dr.Web virus database: 2011-07-27

Virus description added: 2011-07-27

Technical Information

Malicious functions:

Creates and executes the following:

%CommonProgramFiles%\Download\mc-110-12-0000488.exe (downloaded from the Internet)
%WINDIR%\mc-110-12-0000488.exe
%WINDIR%\hostsmgr.exe

Executes the following:

<SYSTEM32>\net.exe stop ccSetMgr /y
<SYSTEM32>\net1.exe stop navapsvc /y
<SYSTEM32>\net1.exe stop ccSetMgr /y
<SYSTEM32>\net1.exe stop DefWatch /y
<SYSTEM32>\net.exe stop DefWatch /y
<SYSTEM32>\net1.exe stop MCVSRte
<SYSTEM32>\net.exe stop MCVSRte
<SYSTEM32>\net.exe stop ccevtmgr/y
<SYSTEM32>\net.exe stop navapsvc /y
<SYSTEM32>\net1.exe stop ccevtmgr/y
<SYSTEM32>\net.exe stop savscan /y
<SYSTEM32>\net1.exe stop "Symantec AntiVirus" /y
<SYSTEM32>\net.exe stop "Symantec AntiVirus" /y
<SYSTEM32>\attrib.exe +s +h registernow.pdf
<SYSTEM32>\attrib.exe +s +h removefunc.ram
<SYSTEM32>\attrib.exe +s +h initiatefunc.dll
<SYSTEM32>\net.exe stop ccevtmgr /y
<SYSTEM32>\net1.exe stop savscan /y
<SYSTEM32>\net1.exe stop ccevtmgr /y
<SYSTEM32>\net1.exe stop ccProxy /y
<SYSTEM32>\net.exe stop ccProxy /y
<SYSTEM32>\net1.exe stop McTaskManager
<SYSTEM32>\net.exe stop AVGEMS
<SYSTEM32>\net1.exe stop AvgFsh
<SYSTEM32>\net1.exe stop AVGEMS
<SYSTEM32>\net1.exe stop Avg7Alrt
<SYSTEM32>\net.exe stop Avg7Alrt
<SYSTEM32>\net1.exe stop AvgServ
<SYSTEM32>\net.exe stop AvgServ
<SYSTEM32>\net.exe stop AvgCore
<SYSTEM32>\net.exe stop AvgFsh
<SYSTEM32>\net1.exe stop AvgCore
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\net1.exe stop McShield
<SYSTEM32>\net.exe stop McShield
<SYSTEM32>\net.exe stop AlertManger
<SYSTEM32>\net.exe stop McTaskManager
<SYSTEM32>\net1.exe stop AlertManger
<SYSTEM32>\net.exe stop aswUpdSv
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\net1.exe stop aswUpdSv
<SYSTEM32>\net1.exe stop npfmntor
<SYSTEM32>\net.exe stop npfmntor

Modifies file system :

Creates the following files:

%TEMP%\nst2.tmp\System.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\launcher[1].exe
%CommonProgramFiles%\Download\mc-110-12-0000488.exe
%WINDIR%\0313.INS
%WINDIR%\86102025.INS
%TEMP%\bt8365.bat

Sets the 'hidden' attribute to the following files:

%TEMP%\bt8365.bat

Deletes the following files:

%TEMP%\nst2.tmp\System.dll
%CommonProgramFiles%\Download\mc-110-12-0000488.exe

Network activity:

Connects to:

'me###.matcash.com':80
'localhost':1035

TCP:

HTTP GET requests:

me###.matcash.com/wrapper/launcher.exe

UDP:

DNS ASK me###.matcash.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial