Trojan.Siggen14.37796

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\circlass] 'ImagePath' = 'system32\DRIVERS\circlass.sys'

Creates the following services

'circlass' system32\DRIVERS\circlass.sys

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM QuickStart.exe
'<SYSTEM32>\taskkill.exe' /F /IM "IR Learning Wizard.exe"
'<SYSTEM32>\taskkill.exe' /F /IM QuickTV.exe
'<SYSTEM32>\taskkill.exe' /F /IM ehunserv.exe
'<SYSTEM32>\taskkill.exe' /F /IM AVerTV.exe

Modifies file system

Creates the following files

%TEMP%\nsr20.tmp\system.dll
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\install.bmp
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\installdriver.exe
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\installtool.exe
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\merlind.rom
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\remove.bmp
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\removedriver.exe
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6a75.tmp
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6b51.tmp
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6c3c.tmp
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6d46.tmp
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6e02.tmp
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avkscir.cat
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6eaf.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set961d.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set96c9.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set97a5.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set9871.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set991d.tmp
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set99d9.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc685.tmp
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc732.tmp
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc7df.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\cpnotify.ax
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\cxtvrate.dll
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\avpoldir.cat
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\avpolcir_h831.inf
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\avpolcir.sys
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avpolcir.sys
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avpolcir_h831.inf
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\averpola.sys
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\averpola_0831.inf
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\averpola_1831.inf
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\install.bmp
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installdriver.exe
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installtool.exe
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\merlind.rom
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\remove.bmp
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\removedriver.exe
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avermedia h831 usb hybrid dvb-tt2.url
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\averpola.cat
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avpoldir.cat
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\cpnotify.ax
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\cxtvrate.dll
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\21f798c9-840a-4374-ad23-460d5cd6cb53.devicemetadata-ms
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\21f798c9-840a-4374-ad23-460d5cd6cb53.devicemetadata-ms
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\averpola.cat
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\averpola.sys
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\averpola_0831.inf
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\averpola_1831.inf
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\avkscir.cat
%WINDIR%\driver cache\avermedia\averpola_10.2.64.110\avpolcir.cat
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\21f798c9-840a-4374-ad23-460d5cd6cb53.devicemetadata-ms
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\avpolcir.cat
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\uninst.exe

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Deletes the following files

%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola.cat
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir_h831.inf
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir.sys
%TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir.cat
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\merlind.rom
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\cxtvrate.dll
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\cpnotify.ax
%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installdriver.exe
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola_1831.inf
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola.cat
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\merlind.rom
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\cxtvrate.dll
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\cpnotify.ax
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola_0831.inf
%TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola.sys
%TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola.sys
%TEMP%\nsr20.tmp\system.dll

Moves the following files

from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6a75.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\merlind.rom
from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6b51.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\cpnotify.ax
from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6c3c.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola.cat
from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6d46.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\cxtvrate.dll
from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6e02.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola.sys
from %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\set6eaf.tmp to %TEMP%\{3667f252-3b12-427d-c6a3-8753ebb32703}\averpola_0831.inf
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set961d.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\merlind.rom
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set96c9.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\cpnotify.ax
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set97a5.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola.cat
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set9871.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\cxtvrate.dll
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set991d.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola.sys
from %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\set99d9.tmp to %TEMP%\{33fecbfe-e321-7a9b-8c02-805edaa1c52b}\averpola_1831.inf
from %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc685.tmp to %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir_h831.inf
from %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc732.tmp to %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir.cat
from %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\setc7df.tmp to %TEMP%\{50b15a71-7af6-2d4b-9726-8b774447e540}\avpolcir.sys

Modifies the following files

Miscellaneous

Searches for the following windows

ClassName: 'AVerQTApp' WindowName: ''
ClassName: 'AVerTrayIconAPP' WindowName: ''
ClassName: 'AVerQuickApp' WindowName: ''
ClassName: 'AmaQuickStart' WindowName: ''
ClassName: 'QuickTVApp' WindowName: ''
ClassName: '' WindowName: 'eHome Service'
ClassName: 'AVerTVApp' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'tooltips_class32' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installtool.exe' sc.exe stop AVerRECentral
'%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installdriver.exe' /s
'%ProgramFiles(x86)%\avermedia\avermedia h831 usb hybrid dvb-tt2\installtool.exe' sc.exe start AVerRECentral
'<SYSTEM32>\taskkill.exe' /F /IM QuickStart.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM "IR Learning Wizard.exe"' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM QuickTV.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM ehunserv.exe' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM AVerTV.exe' (with hidden window)
'<SYSTEM32>\net.exe' start AVerCardbusService' (with hidden window)
'<SYSTEM32>\net.exe' start AVerRemote' (with hidden window)
'<SYSTEM32>\net.exe' start AVerIrScheduleService' (with hidden window)
'<SYSTEM32>\net.exe' start AVerMCEService' (with hidden window)
'<SYSTEM32>\net.exe' start "SnugTV Service"' (with hidden window)

Executes the following

'<SYSTEM32>\sc.exe' stop AVerRECentral
'<SYSTEM32>\net.exe' start AVerCardbusService
'<SYSTEM32>\net1.exe' start AVerCardbusService
'<SYSTEM32>\net.exe' start AVerRemote
'<SYSTEM32>\net.exe' start AVerIrScheduleService
'<SYSTEM32>\net.exe' start AVerMCEService
'<SYSTEM32>\net1.exe' start AVerIrScheduleService
'<SYSTEM32>\net1.exe' start AVerRemote
'<SYSTEM32>\net1.exe' start AVerMCEService
'<SYSTEM32>\net.exe' start "SnugTV Service"
'<SYSTEM32>\net1.exe' start "SnugTV Service"
'<SYSTEM32>\sc.exe' start AVerRECentral

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial