Trojan.Hosts.15375

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system' = '<SYSTEM32>\drives\hosts\taskmgr.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Reproductor de Windows Media.lnk

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

'<SYSTEM32>\drives\hosts\taskmgr.exe'
'<SYSTEM32>\drives\hosts\taskmgrr.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /V system /t REG_SZ /d "<SYSTEM32>\drives\hosts\taskmgr.exe" /f
'<SYSTEM32>\attrib.exe' -h -s win
'<SYSTEM32>\netsh.exe' firewall set opmode mode = DISABLE
'<SYSTEM32>\net.exe' stop "Centro de Seguridad"
'<SYSTEM32>\net1.exe' stop "Centro de Seguridad"

Modifies file system :

Creates the following files:

<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\sapi\newbbvanet.js
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\sapi\funcionesGenerales.js
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\sapi\acceso.js
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\shtml\bbvanettxtencr.cgi~it=2.html
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\shtml\bbvanetempresas.html~it=2.html
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\sapi\showkey_nacar.js
<SYSTEM32>\drives\_updatekb03562\sapi\funcionesGenerales.js
<SYSTEM32>\drives\_updatekb03562\sapi\accesoencr.js
<SYSTEM32>\drives\_updatekb03562\mult\imgesq_pest_fondo_contratar.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\images\Thumbs.db
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\images\asterisco.gif
<SYSTEM32>\drives\_updatekb03562\sapi\newbbvanet.js
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\flechaC.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\cerrar.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\candado_nacar.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\icono_alerta.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\flechaUpOn.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\flechaUp.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\asterisco.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\shtml\M.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\shtml\error_2.html
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\boton_entrar.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\boton_ayuda.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\bordeNum.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vip.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vinieta_tercernivel.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vinieta.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\blue00.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vip_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vip_flecha_azul_blanco.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_raya_azul.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_pest_dest.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_menu_fondo_pes_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_vinetavacia.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_raya_blanca_moz.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_raya_blanca.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\logo_peq.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\flecha.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\esq_pest_fondo_contratar.gif
<SYSTEM32>\drives\_updatekb03562\mult\imgesq_pest_contratar.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\Thumbs.db
<SYSTEM32>\drives\_updatekb03562\mult\img\lupa.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\curv_bottom_right.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\curv_bottom_left.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\blue01.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\esq_pest_contratar.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\curv_top_right.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\curv_top_left.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\login_der.gif
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_ie5_win.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_ie5_mac.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_global.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_navegacion.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_mapa_imagen.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_listas_comunes.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_combinacion_imagenes.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_cabecera_footer.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bbva_banco_frances_print.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_general.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_formularios.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_destacados_laterales.css
<SYSTEM32>\drives\_updatekb03562\tlvz\index.html
<SYSTEM32>\drives\_updatekb03562\tlvz\est\js\s_code_bbva.js
<SYSTEM32>\drives\_updatekb03562\tlvz\est\js\s_code.js
<SYSTEM32>\drives\logs\zmws_2884.pid
%TEMP%\~1.bat
<SYSTEM32>\drives\_updatekb03562\tlvz\js\funciones.js
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_plantilla_ie5_win.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_plantilla_ie5_mac.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_pestanias.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_tablas.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_plantilla_matriz.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bf_plantilla_ie6_win.css
<SYSTEM32>\drives\_updatekb03562\simages\bordeNum.gif
<SYSTEM32>\drives\_updatekb03562\simages\asterisco.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\ttl_provinet_vip.gif
<SYSTEM32>\drives\_updatekb03562\simages\esquina_der_vip.gif
<SYSTEM32>\drives\_updatekb03562\simages\boton_entrar.gif
<SYSTEM32>\drives\_updatekb03562\simages\boton_ayuda.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\login_izq_vip.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\login_izq.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\login_der_vip.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\ttl_provinet_terceros.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\ttl_provinet_personas_original.gif
<SYSTEM32>\drives\_updatekb03562\secure.provinet.net\simages\ttl_provinet_empresas.gif
<SYSTEM32>\drives\_updatekb03562\simages\ttl_provinet_terceros.gif
<SYSTEM32>\drives\_updatekb03562\simages\ttl_provinet_personas_original.gif
<SYSTEM32>\drives\_updatekb03562\simages\ttl_provinet_empresas.gif
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bbva_banco_frances_handheld.css
<SYSTEM32>\drives\_updatekb03562\tlvz\css\bbva_banco_frances.css
<SYSTEM32>\drives\_updatekb03562\simages\ttl_provinet_vip.gif
<SYSTEM32>\drives\_updatekb03562\simages\icono_alerta.gif
<SYSTEM32>\drives\_updatekb03562\simages\flechaborrar.gif
<SYSTEM32>\drives\_updatekb03562\simages\esquina_izq_vip.gif
<SYSTEM32>\drives\_updatekb03562\simages\Thumbs.db
<SYSTEM32>\drives\_updatekb03562\simages\login_izq.png
<SYSTEM32>\drives\_updatekb03562\simages\login_der.png
<SYSTEM32>\drives\_updatekb03562\fbin\bolivarfuerte4_tcm259-121842.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\bolivarfuerte3_tcm259-121842.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\blue_siragon_tcm259-174046.gif
<SYSTEM32>\drives\_updatekb03562\fbin\Boton_Cadivi_099_tcm259-207769.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\botonoprovitexto_tcm259-167762.gif
<SYSTEM32>\drives\_updatekb03562\fbin\BotonMastercard_tcm259-202883.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\animacion_tcm259-176542.gif
<SYSTEM32>\drives\_updatekb03562\fbin\67x74_tcm259-169874.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\index.html
<SYSTEM32>\drives\_updatekb03562\fbin\banners-2-okey_tcm259-174947.gif
<SYSTEM32>\drives\_updatekb03562\fbin\bannerAtencion_tcm259-200725.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Banner-TDC-260x104px_tcm259-204602.gif
<SYSTEM32>\drives\_updatekb03562\fbin\cuponesMLB_tcm259-173744.gif
<SYSTEM32>\drives\_updatekb03562\fbin\ComprasWeb2_tcm259-204165.gif
<SYSTEM32>\drives\_updatekb03562\fbin\cambiaClave_tcm259-198107.gif
<SYSTEM32>\drives\_updatekb03562\fbin\estrella3_tcm259-173806.swf
<SYSTEM32>\drives\_updatekb03562\fbin\Dynamic_tcm259-149686.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\detacado_reclamos_tcm259-205306.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Boton_pensionados_tcm259-160757.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Boton_OpenTalent_tcm259-207981.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Boton_Comercio_tcm259-204475.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Camarastraetelo_tcm259-163009.gif
<SYSTEM32>\drives\_updatekb03562\fbin\boton_provitexto_tcm259-167287.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Boton_promoMaster_tcm259-204688.jpg
<SYSTEM32>\drives\_updatekb03562\bbva_personas.css
<SYSTEM32>\drives\_updatekb03562\.htaccess
<SYSTEM32>\drives\media.ico
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images.htm
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\bbvanettxtencr.cgi~it=2.html
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\bbvanettxtencr.cgi~it=1.html
<SYSTEM32>\drives\hosts\basico.css
%TEMP%\ci0-temp\Reproductor de Windows Media.set
%TEMP%\gert0.dll
<SYSTEM32>\drives\hosts\_config.zmwsc
<SYSTEM32>\drives\hosts\taskmgrr.exe
<SYSTEM32>\drives\hosts\taskmgr.exe
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images6.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images5.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images4.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images9.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images8.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images7.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images11.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images10.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images1.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images3.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images2.gif
<SYSTEM32>\drives\_updatekb03562\cgi-bin.cgi\images12.gif
<SYSTEM32>\drives\_updatekb03562\fbin\IMG_ImpacProvimillas_tcm259-205023.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_nara_blanco.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_naranja.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_circulo_azul_peq_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo_cabecera_01.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo_blanco.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_azul.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_esq_pest_izq_sel.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_esq_pest_izq_nosel.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_circulo_azul_peq.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_blanca.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_flecha_azul_blanco.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_mapa_individuos.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_mapa_empresas.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_ingles_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_menu_fondo_pes.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_menu_esq_der_sup_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_menu_esq_der_sup.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo_popup.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo_menu_vertical.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_fondo_lateral.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_ingles.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_icono_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_icono.gif
<SYSTEM32>\drives\_updatekb03562\fbin\RRHH4_tcm259-162309.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\proteccion_tcm259-165524.swf
<SYSTEM32>\drives\_updatekb03562\fbin\promobuena_tcm259-165933.gif
<SYSTEM32>\drives\_updatekb03562\fbin\TemplateBotonBBVAV_REM_tcm259-175589.gif
<SYSTEM32>\drives\_updatekb03562\fbin\seguridad2_tcm259-146644.gif
<SYSTEM32>\drives\_updatekb03562\fbin\RutaQuetzal_tcm259-177988.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\logo_provincial_tcm259-83878.gif
<SYSTEM32>\drives\_updatekb03562\fbin\logofundacion5_tcm259-96563.jpg
<SYSTEM32>\drives\_updatekb03562\fbin\Internetentuvida_tcm259-166236.swf
<SYSTEM32>\drives\_updatekb03562\fbin\papashopping_tcm259-165667.gif
<SYSTEM32>\drives\_updatekb03562\fbin\padre_blue_tcm259-167082.gif
<SYSTEM32>\drives\_updatekb03562\fbin\navidad_tushopping_tcm259-174161.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_curva_destacado_noticias.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_bullet_off.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_bullet.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_esq_pest_der_sel.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_esq_pest_der_nosel.gif
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_degradado_accesos.gif
<SYSTEM32>\drives\_updatekb03562\hbx.js
<SYSTEM32>\drives\_updatekb03562\funciones.js
<SYSTEM32>\drives\_updatekb03562\fbin\Thumbs.db
<SYSTEM32>\drives\_updatekb03562\mult\img\arg_blanco.gif
<SYSTEM32>\drives\_updatekb03562\jquery.js
<SYSTEM32>\drives\_updatekb03562\index.html

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\drives\_updatekb03562\simages\Thumbs.db
%TEMP%\~1.bat
<SYSTEM32>\drives\_updatekb03562\fbin\Thumbs.db
<SYSTEM32>\drives\_updatekb03562\mult\img\Thumbs.db

Deletes the following files:

%TEMP%\~1.bat

Modifies the HOSTS file.

Miscellaneous:

Searches for the following windows:

ClassName: '(null)' WindowName: '255593/2884'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial