Trojan.DownLoader8.33191

Added to the Dr.Web virus database: 2013-04-03

Virus description added: 2013-04-13

Technical Information

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

Executes the following:

<SYSTEM32>\net1.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net.exe stop "McAfee WSC Integration"
<SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net1.exe stop "NOD32 Kernel Service"
<SYSTEM32>\net1.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net.exe stop "McAfee.com McShield"
<SYSTEM32>\net1.exe stop "SyGateService"
<SYSTEM32>\net1.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\net1.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net1.exe stop "Trend ServerProtect"
<SYSTEM32>\net1.exe stop "Panda Antivirus"
<SYSTEM32>\net.exe stop "NOD32 Kernel Service"
<SYSTEM32>\net1.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net.exe stop "SyGateService"
<SYSTEM32>\net1.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "VSMON"
<SYSTEM32>\net.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "AVP Control Centre Service"
<SYSTEM32>\net1.exe stop "IPSEC Services"
<SYSTEM32>\net1.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "zlclient"
<SYSTEM32>\net.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "ZONEALARM"
<SYSTEM32>\net.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "McAfee WSC Integration"
<SYSTEM32>\net.exe stop "IPSEC Services"
<SYSTEM32>\net.exe stop "AVP Control Centre Service"
<SYSTEM32>\net1.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net.exe stop "ZONEALARM"
<SYSTEM32>\net.exe stop "zlclient"
<SYSTEM32>\net1.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net.exe stop "VSMON"
<SYSTEM32>\net1.exe stop "McAfee.com McShield"
<SYSTEM32>\net1.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "LOCKDOWN2000"
<SYSTEM32>\net1.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "Fprot.exe"
<SYSTEM32>\net.exe stop "Blackice Defender"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop "Fprot.exe"
<SYSTEM32>\net1.exe stop "F-Prot.exe"
<SYSTEM32>\net.exe stop "WyvernWorks Firewall"
<SYSTEM32>\net1.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net.exe stop "Norton Personal Firewall 2001"
<SYSTEM32>\net.exe stop "Norton Internet Security"
<SYSTEM32>\net.exe stop "F-Prot.exe"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net1.exe stop "Norton Internet Security"
<SYSTEM32>\net1.exe stop "Norton Personal Firewall 2001"
<SYSTEM32>\net.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net1.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\net.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "Panda Antivirus"
<SYSTEM32>\net.exe stop "Trend ServerProtect"
<SYSTEM32>\net.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net1.exe stop "LOCKDOWN2000"
<SYSTEM32>\net.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net.exe stop " Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop "Blackice Defender"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop " Sygate Personal Firewall Pro"
<SYSTEM32>\net.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net1.exe stop "WyvernWorks Firewall"

Modifies file system :

Creates the following files:

Network activity:

Connects to:

'un######0tnet.opendns.be':6667

UDP:

DNS ASK un######0tnet.opendns.be

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial