Trojan.Siggen3.13511

Added to the Dr.Web virus database: 2011-10-09

Virus description added: 2011-10-09

Technical Information

Malicious functions:

Executes the following:

<SYSTEM32>\net1.exe stop NAVAPSVC
<SYSTEM32>\net.exe stop NISUM
<SYSTEM32>\net1.exe stop NAVLU32
<SYSTEM32>\net.exe stop NAVAPSVC
<SYSTEM32>\net1.exe stop SYMPROXYSVC
<SYSTEM32>\net.exe stop RESCUE32
<SYSTEM32>\net1.exe stop NISUM
<SYSTEM32>\net.exe stop SYMPROXYSVC
<SYSTEM32>\net.exe stop NAVLU32
<SYSTEM32>\net.exe stop PVIEW95
<SYSTEM32>\net1.exe stop PVIEW95
<SYSTEM32>\net.exe stop F-STOPW
<SYSTEM32>\net1.exe stop F-STOPW
<SYSTEM32>\net.exe stop NAVRUNR
<SYSTEM32>\net1.exe stop NAVRUNR
<SYSTEM32>\net.exe stop NAVWNT
<SYSTEM32>\net1.exe stop NAVWNT
<SYSTEM32>\net.exe stop NMAIN
<SYSTEM32>\net1.exe stop NMAIN
<SYSTEM32>\net.exe stop LUALL
<SYSTEM32>\net1.exe stop LUALL
<SYSTEM32>\net.exe stop NAVAPW32
<SYSTEM32>\net1.exe stop NAVAPW32
<SYSTEM32>\net.exe stop NAVW32
<SYSTEM32>\net1.exe stop NAVW32
<SYSTEM32>\net1.exe stop LUCOMSERVER
<SYSTEM32>\net1.exe stop NISSERV
<SYSTEM32>\net.exe stop ATRACK
<SYSTEM32>\net1.exe stop RESCUE32
<SYSTEM32>\net.exe stop NISSERV
<SYSTEM32>\net1.exe stop IAMAPP
<SYSTEM32>\net.exe stop LUCOMSERVER
<SYSTEM32>\net1.exe stop ATRACK
<SYSTEM32>\net.exe stop IAMAPP
<SYSTEM32>\net1.exe stop CFINET
<SYSTEM32>\net.exe stop ICMON
<SYSTEM32>\net1.exe stop CFINET32
<SYSTEM32>\net.exe stop CFINET
<SYSTEM32>\net1.exe stop SAFEWEB
<SYSTEM32>\net.exe stop WEBSCANX
<SYSTEM32>\net1.exe stop ICMON
<SYSTEM32>\net.exe stop SAFEWEB
<SYSTEM32>\net.exe stop CFINET32
<SYSTEM32>\net1.exe stop УSecurity CenterФ
<SYSTEM32>\net.exe stop SharedAccess
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\Copy of New Text Document.bat""
<SYSTEM32>\net.exe stop УSecurity CenterФ
<SYSTEM32>\net.exe stop AVP.EXE
<SYSTEM32>\net1.exe stop AVP.EXE
<SYSTEM32>\net1.exe stop SharedAccess
<SYSTEM32>\netsh.exe firewall set opmode mode=disable
<SYSTEM32>\net.exe stop IOMON98
<SYSTEM32>\net1.exe stop IOMON98
<SYSTEM32>\net.exe stop FP-WIN
<SYSTEM32>\net1.exe stop FP-WIN
<SYSTEM32>\net.exe stop F-PROT95
<SYSTEM32>\net1.exe stop F-PROT95
<SYSTEM32>\net.exe stop PCCWIN98
<SYSTEM32>\net1.exe stop PCCWIN98
<SYSTEM32>\net1.exe stop NVC95
<SYSTEM32>\net1.exe stop ANTIVIR
<SYSTEM32>\net.exe stop MCAFEE
<SYSTEM32>\net1.exe stop WEBSCANX
<SYSTEM32>\net.exe stop ANTIVIR
<SYSTEM32>\net1.exe stop NORTON
<SYSTEM32>\net.exe stop NVC95
<SYSTEM32>\net1.exe stop MCAFEE
<SYSTEM32>\net.exe stop NORTON

Modifies file system :

Creates the following files:

%TEMP%\1.tmp\Copy of New Text Document.bat

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial