Trojan.DownLoader11.53859

Technical Information

Malicious functions:

Creates and executes the following:

'C:\config\dr\browser\firefox.exe' -URL file:///c:\config\dr\browser\res\virtual_visit_system_10-05-12.htm
'C:\config\dr\browser\firefox.exe' "-URL" "file:///c:\config\dr\browser\res\virtual_visit_system_10-05-12.htm"
'C:\config\dr\setup.exe'
'C:\config\dr\update.exe'

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im update.exe
'<SYSTEM32>\taskkill.exe' /f /im firefox.exe
'<SYSTEM32>\taskkill.exe' /f /im VVisit.exe
'<SYSTEM32>\wscript.exe' "c:\config\dr\$wdd.vbs"
'<SYSTEM32>\cmd.exe' /c ""C:\config\dr\$wdd.bat" /start"

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system :

Creates the following files:

C:\config\dr\browser\defaults\autoconfig\prefcalls.js
C:\config\dr\browser\defaults\pref\channel-prefs.js
C:\config\dr\browser\defaults\autoconfig\platform.js
C:\config\dr\browser\components\xultmpl.xpt
C:\config\dr\browser\components\zipwriter.xpt
C:\config\dr\browser\defaults\pref\firefox-branding.js
C:\config\dr\browser\defaults\profile\bookmarks.html
C:\config\dr\browser\defaults\profile\chrome\userChrome-example.css
C:\config\dr\browser\defaults\pref\reporter.js
C:\config\dr\browser\defaults\pref\firefox-l10n.js
C:\config\dr\browser\defaults\pref\firefox.js
C:\config\dr\browser\components\xuldoc.xpt
C:\config\dr\browser\components\xpcom_ds.xpt
C:\config\dr\browser\components\xpcom_io.xpt
C:\config\dr\browser\components\xpcom_components.xpt
C:\config\dr\browser\components\windowwatcher.xpt
C:\config\dr\browser\components\xpcom_base.xpt
C:\config\dr\browser\components\xpcom_system.xpt
C:\config\dr\browser\components\xpinstall.xpt
C:\config\dr\browser\components\xulapp.xpt
C:\config\dr\browser\components\xpconnect.xpt
C:\config\dr\browser\components\xpcom_thread.xpt
C:\config\dr\browser\components\xpcom_xpti.xpt
C:\config\dr\browser\modules\DownloadUtils.jsm
C:\config\dr\browser\modules\ISO8601DateUtils.jsm
C:\config\dr\browser\modules\distribution.js
C:\config\dr\browser\Microsoft.VC90.CRT.manifest
C:\config\dr\browser\modules\debug.js
C:\config\dr\browser\modules\JSON.jsm
C:\config\dr\browser\modules\XPCOMUtils.jsm
C:\config\dr\browser\msvcm90.dll
C:\config\dr\browser\modules\utils.js
C:\config\dr\browser\modules\Microformats.js
C:\config\dr\browser\modules\PluralForm.jsm
C:\config\dr\browser\js3250.dll
C:\config\dr\browser\defaults\profile\prefs.js
C:\config\dr\browser\firefox.exe
C:\config\dr\browser\defaults\profile\mimeTypes.rdf
C:\config\dr\browser\defaults\profile\chrome\userContent-example.css
C:\config\dr\browser\defaults\profile\localstore.rdf
C:\config\dr\browser\freebl3.chk
C:\config\dr\browser\greprefs\xpinstall.js
C:\config\dr\browser\IA2Marshal.dll
C:\config\dr\browser\greprefs\security-prefs.js
C:\config\dr\browser\freebl3.dll
C:\config\dr\browser\greprefs\all.js
C:\config\dr\browser\components\places.xpt
C:\config\dr\browser\components\pluginGlue.js
C:\config\dr\browser\components\pippki.xpt
C:\config\dr\browser\components\pipboot.xpt
C:\config\dr\browser\components\pipnss.xpt
C:\config\dr\browser\components\pref.xpt
C:\config\dr\browser\components\rdf.xpt
C:\config\dr\browser\components\satchel.xpt
C:\config\dr\browser\components\proxyObject.xpt
C:\config\dr\browser\components\prefetch.xpt
C:\config\dr\browser\components\profile.xpt
C:\config\dr\browser\components\parentalcontrols.xpt
C:\config\dr\browser\components\nsTaggingService.js
C:\config\dr\browser\components\nsTryToClose.js
C:\config\dr\browser\components\nsSidebar.js
C:\config\dr\browser\components\nsSessionStore.js
C:\config\dr\browser\components\nsSetDefaultBrowser.js
C:\config\dr\browser\components\nsUpdateService.js
C:\config\dr\browser\components\nsWebHandlerApp.js
C:\config\dr\browser\components\oji.xpt
C:\config\dr\browser\components\nsURLFormatter.js
C:\config\dr\browser\components\nsUrlClassifierLib.js
C:\config\dr\browser\components\nsUrlClassifierListManager.js
C:\config\dr\browser\components\url-classifier.xpt
C:\config\dr\browser\components\urlformatter.xpt
C:\config\dr\browser\components\uriloader.xpt
C:\config\dr\browser\components\unicharutil.xpt
C:\config\dr\browser\components\update.xpt
C:\config\dr\browser\components\webbrowserpersist.xpt
C:\config\dr\browser\components\widget.xpt
C:\config\dr\browser\components\windowds.xpt
C:\config\dr\browser\components\webshell_idls.xpt
C:\config\dr\browser\components\webBrowser_core.xpt
C:\config\dr\browser\components\WebContentConverter.js
C:\config\dr\browser\components\uconv.xpt
C:\config\dr\browser\components\shistory.xpt
C:\config\dr\browser\components\spellchecker.xpt
C:\config\dr\browser\components\shellservice.xpt
C:\config\dr\browser\components\saxparser.xpt
C:\config\dr\browser\components\sessionstore.xpt
C:\config\dr\browser\components\storage-Legacy.js
C:\config\dr\browser\components\txmgr.xpt
C:\config\dr\browser\components\txtsvc.xpt
C:\config\dr\browser\components\txEXSLTRegExFunctions.js
C:\config\dr\browser\components\storage.xpt
C:\config\dr\browser\components\toolkitprofile.xpt
C:\config\dr\browser\res\table-remove-column-hover.gif
C:\config\dr\browser\res\table-remove-column.gif
C:\config\dr\browser\res\table-remove-column-active.gif
C:\config\dr\browser\res\table-add-row-before-hover.gif
C:\config\dr\browser\res\table-add-row-before.gif
C:\config\dr\browser\res\table-remove-row-active.gif
C:\config\dr\browser\res\tbc_vvt_temp_6.txt
C:\config\dr\browser\res\ua.css
C:\config\dr\browser\res\tbc_vvt_temp_4.txt
C:\config\dr\browser\res\table-remove-row-hover.gif
C:\config\dr\browser\res\table-remove-row.gif
C:\config\dr\browser\res\table-add-row-before-active.gif
C:\config\dr\browser\res\table-add-column-after-hover.gif
C:\config\dr\browser\res\table-add-column-after.gif
C:\config\dr\browser\res\table-add-column-after-active.gif
C:\config\dr\browser\res\quirk.css
C:\config\dr\browser\res\svg.css
C:\config\dr\browser\res\table-add-column-before-active.gif
C:\config\dr\browser\res\table-add-row-after-hover.gif
C:\config\dr\browser\res\table-add-row-after.gif
C:\config\dr\browser\res\table-add-row-after-active.gif
C:\config\dr\browser\res\table-add-column-before-hover.gif
C:\config\dr\browser\res\table-add-column-before.gif
C:\config\dr\config.ini
C:\config\dr\system.ini
C:\config\dr\appface.dll
C:\config\dr\browser\xpcom.dll
C:\config\dr\browser\xul.dll
C:\config\dr\update.exe
C:\config\dr\browser\appdata\extensions-1.rdf
C:\config\dr\browser\appdata\prefs-1.js
C:\config\dr\browser\appdata\extensions-1.ini
%APPDATA%\gMozilla\gFirefox\profiles.ini
C:\config\dr\browser\appdata\extensions-1.cache
C:\config\dr\browser\vvt_state.ini
C:\config\dr\browser\res\wincharset.properties
C:\config\dr\browser\royale.urf
C:\config\dr\browser\res\virtual_visit_system_10-11-25.htm
C:\config\dr\browser\res\viewsource.css
C:\config\dr\browser\res\virtual_visit_system_10-05-12.htm
C:\config\dr\browser\smime3.dll
C:\config\dr\browser\sqlitexx.dll
C:\config\dr\browser\ssl3.dll
C:\config\dr\browser\sqlite3.dll
C:\config\dr\browser\softokn3.chk
C:\config\dr\browser\softokn3.dll
C:\config\dr\browser\res\arrow.gif
C:\config\dr\browser\res\arrowd.gif
C:\config\dr\browser\pxy\privoxy.dll
C:\config\dr\browser\pxy\default.filter
C:\config\dr\browser\pxy\mgwz.dll
C:\config\dr\browser\res\broken-image.gif
C:\config\dr\browser\res\designmode.css
C:\config\dr\browser\res\dtd\mathml.dtd
C:\config\dr\browser\res\contenteditable.css
C:\config\dr\browser\res\charsetalias.properties
C:\config\dr\browser\res\charsetData.properties
C:\config\dr\browser\pxy\default.action
C:\config\dr\browser\nss3.dll
C:\config\dr\browser\nssckbi.dll
C:\config\dr\browser\nspr4.dll
C:\config\dr\browser\msvcp90.dll
C:\config\dr\browser\msvcr90.dll
C:\config\dr\browser\nssdbm3.dll
C:\config\dr\browser\plds4.dll
C:\config\dr\browser\pxy\config.txt
C:\config\dr\browser\plc4.dll
C:\config\dr\browser\nssutil3.dll
C:\config\dr\browser\platform.ini
C:\config\dr\browser\res\grabber.gif
C:\config\dr\browser\res\hiddenWindow.html
C:\config\dr\browser\res\forms.css
C:\config\dr\browser\res\fonts\mathfontSymbol.properties
C:\config\dr\browser\res\fonts\mathfontUnicode.properties
C:\config\dr\browser\res\html\folder.png
C:\config\dr\browser\res\loading-image.gif
C:\config\dr\browser\res\mathml.css
C:\config\dr\browser\res\language.properties
C:\config\dr\browser\res\html.css
C:\config\dr\browser\res\langGroups.properties
C:\config\dr\browser\res\fonts\mathfontSTIXSize1.properties
C:\config\dr\browser\res\entityTables\html40Special.properties
C:\config\dr\browser\res\entityTables\html40Symbols.properties
C:\config\dr\browser\res\entityTables\html40Latin1.properties
C:\config\dr\browser\res\dtd\xhtml11.dtd
C:\config\dr\browser\res\EditorOverride.css
C:\config\dr\browser\res\entityTables\htmlEntityVersions.properties
C:\config\dr\browser\res\fonts\mathfontStandardSymbolsL.properties
C:\config\dr\browser\res\fonts\mathfontSTIXNonUnicode.properties
C:\config\dr\browser\res\fonts\mathfont.properties
C:\config\dr\browser\res\entityTables\mathml20.properties
C:\config\dr\browser\res\entityTables\transliterate.properties
C:\config\dr\browser\components\nsSessionStartup.js
C:\config\dr\browser\chrome\zh-CN.manifest
C:\config\dr\browser\components\aboutRights.js
C:\config\dr\browser\chrome\zh-CN.jar
C:\config\dr\browser\chrome\toolkit.manifest
C:\config\dr\browser\chrome\troot.conf
C:\config\dr\browser\components\aboutRobots.js
C:\config\dr\browser\components\appshell.xpt
C:\config\dr\browser\components\appstartup.xpt
C:\config\dr\browser\components\alerts.xpt
C:\config\dr\browser\components\accessibility-msaa.xpt
C:\config\dr\browser\components\accessibility.xpt
C:\config\dr\browser\chrome\toolkit.jar
C:\config\dr\browser\chrome\classic.manifest
C:\config\dr\browser\chrome\comm.jar
C:\config\dr\browser\chrome\classic.jar
C:\config\dr\browser\chrome\browser.jar
C:\config\dr\browser\chrome\browser.manifest
C:\config\dr\browser\chrome\comm.manifest
C:\config\dr\browser\chrome\reporter.jar
C:\config\dr\browser\chrome\reporter.manifest
C:\config\dr\browser\chrome\pippki.manifest
C:\config\dr\browser\chrome\default.jar
C:\config\dr\browser\chrome\pippki.jar
C:\config\dr\browser\components\content_base.xpt
C:\config\dr\browser\components\content_html.xpt
C:\config\dr\browser\components\contentprefs.xpt
C:\config\dr\browser\components\commandlines.xpt
C:\config\dr\browser\components\composer.xpt
C:\config\dr\browser\components\content_htmldoc.xpt
C:\config\dr\browser\components\cookie.xpt
C:\config\dr\browser\components\directory.xpt
C:\config\dr\browser\components\content_xtf.xpt
C:\config\dr\browser\components\content_xmldoc.xpt
C:\config\dr\browser\components\content_xslt.xpt
C:\config\dr\browser\components\commandhandler.xpt
C:\config\dr\browser\components\browsercompsbase.xpt
C:\config\dr\browser\components\browserdirprovider.dll
C:\config\dr\browser\components\browser-feeds.xpt
C:\config\dr\browser\components\autocomplete.xpt
C:\config\dr\browser\components\autoconfig.xpt
C:\config\dr\browser\components\browserplaces.xpt
C:\config\dr\browser\components\chardet.xpt
C:\config\dr\browser\components\chrome.xpt
C:\config\dr\browser\components\caps.xpt
C:\config\dr\browser\components\browsersearch.xpt
C:\config\dr\browser\components\brwsrcmp.dll
C:\config\dr\browser\appdata\downloads.sqlite
C:\config\dr\browser\appdata\extensions\vvisit@www.virtualvisit.cn\chrome.manifest
C:\config\dr\browser\appdata\cookies.sqlite
C:\config\dr\browser\appdata\compreg.dat
C:\config\dr\browser\appdata\content-prefs.sqlite
C:\config\dr\browser\appdata\extensions\vvisit@www.virtualvisit.cn\content\function.js
C:\config\dr\browser\appdata\extensions.cache
C:\config\dr\browser\appdata\extensions.ini
C:\config\dr\browser\appdata\extensions\vvisit@www.virtualvisit.cn\install.rdf
C:\config\dr\browser\appdata\extensions\vvisit@www.virtualvisit.cn\content\overlay.xul
C:\config\dr\browser\appdata\extensions\vvisit@www.virtualvisit.cn\content\vvisit.js
C:\config\dr\browser\appdata\compatibility.ini
C:\config\dr\setup.exe
C:\config\dr\1.mp3
C:\config\dr\sc.vbs
C:\config\dr\$wdd.bat
C:\config\dr\$wdd.vbs
C:\config\dr\browser\AccessibleMarshal.dll
C:\config\dr\browser\appdata\Cache\_CACHE_MAP_
C:\config\dr\browser\appdata\cert8.db
C:\config\dr\browser\appdata\Cache\_CACHE_003_
C:\config\dr\browser\appdata\Cache\_CACHE_001_
C:\config\dr\browser\appdata\Cache\_CACHE_002_
C:\config\dr\browser\appdata\user.js
C:\config\dr\browser\appdata\webappsstore.sqlite
C:\config\dr\browser\appdata\urlclassifier3.sqlite
C:\config\dr\browser\appdata\sessionstore.js
C:\config\dr\browser\appdata\signons3.txt
C:\config\dr\browser\appdata\XPC.mfl
C:\config\dr\browser\application.ini
C:\config\dr\browser\blocklist.xml
C:\config\dr\browser\appdata\XUL.mfl
C:\config\dr\browser\appdata\XPC1.mfl
C:\config\dr\browser\appdata\xpti.dat
C:\config\dr\browser\appdata\secmod.db
C:\config\dr\browser\appdata\localstore.rdf
C:\config\dr\browser\appdata\mimeTypes.rdf
C:\config\dr\browser\appdata\key3.db
C:\config\dr\browser\appdata\extensions.rdf
C:\config\dr\browser\appdata\formhistory.sqlite
C:\config\dr\browser\appdata\OfflineCache\index.sqlite
C:\config\dr\browser\appdata\prefs.js
C:\config\dr\browser\appdata\search.sqlite
C:\config\dr\browser\appdata\places.sqlite-journal
C:\config\dr\browser\appdata\permissions.sqlite
C:\config\dr\browser\appdata\places.sqlite
C:\config\dr\browser\components\necko_ftp.xpt
C:\config\dr\browser\components\necko_http.xpt
C:\config\dr\browser\components\necko_file.xpt
C:\config\dr\browser\components\necko_cookie.xpt
C:\config\dr\browser\components\necko_dns.xpt
C:\config\dr\browser\components\necko_res.xpt
C:\config\dr\browser\components\nsAddonRepository.js
C:\config\dr\browser\components\nsBadCertHandler.js
C:\config\dr\browser\components\necko_viewsource.xpt
C:\config\dr\browser\components\necko_socket.xpt
C:\config\dr\browser\components\necko_strconv.xpt
C:\config\dr\browser\components\necko_cache.xpt
C:\config\dr\browser\components\lwbrk.xpt
C:\config\dr\browser\components\microsummaries.xpt
C:\config\dr\browser\components\loginmgr.xpt
C:\config\dr\browser\components\layout_xul_tree.xpt
C:\config\dr\browser\components\locale.xpt
C:\config\dr\browser\components\migration.xpt
C:\config\dr\browser\components\necko.xpt
C:\config\dr\browser\components\necko_about.xpt
C:\config\dr\browser\components\mozfind.xpt
C:\config\dr\browser\components\mimetype.xpt
C:\config\dr\browser\components\mozbrwsr.xpt
C:\config\dr\browser\components\nsPlacesTransactionsService.js
C:\config\dr\browser\components\nsPostUpdateWin.js
C:\config\dr\browser\components\nsMicrosummaryService.js
C:\config\dr\browser\components\nsLoginManager.js
C:\config\dr\browser\components\nsLoginManagerPrompter.js
C:\config\dr\browser\components\nsProgressDialog.js
C:\config\dr\browser\components\nsSearchService.js
C:\config\dr\browser\components\nsSearchSuggestions.js
C:\config\dr\browser\components\nsSafebrowsingApplication.js
C:\config\dr\browser\components\nsProxyAutoConfig.js
C:\config\dr\browser\components\nsResetPref.js
C:\config\dr\browser\components\nsLoginInfo.js
C:\config\dr\browser\components\nsContentDispatchChooser.js
C:\config\dr\browser\components\nsContentPrefService.js
C:\config\dr\browser\components\nsBrowserGlue.js
C:\config\dr\browser\components\nsBlocklistService.js
C:\config\dr\browser\components\nsBrowserContentHandler.js
C:\config\dr\browser\components\nsDefaultCLH.js
C:\config\dr\browser\components\nsHelperAppDlg.js
C:\config\dr\browser\components\nsLivemarkService.js
C:\config\dr\browser\components\nsHandlerService.js
C:\config\dr\browser\components\nsDownloadManagerUI.js
C:\config\dr\browser\components\nsExtensionManager.js
C:\config\dr\browser\components\dom_svg.xpt
C:\config\dr\browser\components\dom_traversal.xpt
C:\config\dr\browser\components\dom_stylesheets.xpt
C:\config\dr\browser\components\dom_sidebar.xpt
C:\config\dr\browser\components\dom_storage.xpt
C:\config\dr\browser\components\dom_views.xpt
C:\config\dr\browser\components\downloads.xpt
C:\config\dr\browser\components\editor.xpt
C:\config\dr\browser\components\dom_xul.xpt
C:\config\dr\browser\components\dom_xbl.xpt
C:\config\dr\browser\components\dom_xpath.xpt
C:\config\dr\browser\components\dom_range.xpt
C:\config\dr\browser\components\dom_canvas.xpt
C:\config\dr\browser\components\dom_core.xpt
C:\config\dr\browser\components\dom_base.xpt
C:\config\dr\browser\components\docshell_base.xpt
C:\config\dr\browser\components\dom.xpt
C:\config\dr\browser\components\dom_css.xpt
C:\config\dr\browser\components\dom_loadsave.xpt
C:\config\dr\browser\components\dom_offline.xpt
C:\config\dr\browser\components\dom_json.xpt
C:\config\dr\browser\components\dom_events.xpt
C:\config\dr\browser\components\dom_html.xpt
C:\config\dr\browser\components\imglib2.xpt
C:\config\dr\browser\components\inspector.xpt
C:\config\dr\browser\components\imgicon.xpt
C:\config\dr\browser\components\gfx.xpt
C:\config\dr\browser\components\htmlparser.xpt
C:\config\dr\browser\components\intl.xpt
C:\config\dr\browser\components\layout_base.xpt
C:\config\dr\browser\components\layout_xul.xpt
C:\config\dr\browser\components\jsdservice.xpt
C:\config\dr\browser\components\jar.xpt
C:\config\dr\browser\components\jsconsole-clhandler.js
C:\config\dr\browser\components\fuelApplication.js
C:\config\dr\browser\components\exthelper.xpt
C:\config\dr\browser\components\fastfind.xpt
C:\config\dr\browser\components\exthandler.xpt
C:\config\dr\browser\components\embed_base.xpt
C:\config\dr\browser\components\extensions.xpt
C:\config\dr\browser\components\FeedConverter.js
C:\config\dr\browser\components\find.xpt
C:\config\dr\browser\components\fuel.xpt
C:\config\dr\browser\components\FeedWriter.js
C:\config\dr\browser\components\FeedProcessor.js
C:\config\dr\browser\components\feeds.xpt

Sets the 'hidden' attribute to the following files:

C:\config\dr\config.ini
C:\config\dr\appface.dll
C:\config\dr\update.exe
C:\config\dr\system.ini
C:\config\dr\$wdd.vbs
C:\config\dr\$wdd.bat
C:\config\dr\setup.exe
C:\config\dr\sc.vbs

Deletes the following files:

C:\config\dr\browser\appdata\XUL.mfl
C:\config\dr\browser\appdata\XPC.mfl
C:\config\dr\browser\appdata\extensions.ini
C:\config\dr\browser\appdata\compreg.dat
C:\config\dr\browser\appdata\xpti.dat

Moves the following files:

from C:\config\dr\browser\appdata\extensions-1.ini to C:\config\dr\browser\appdata\extensions.ini
from C:\config\dr\browser\appdata\extensions-1.rdf to C:\config\dr\browser\appdata\extensions.rdf
from C:\config\dr\browser\appdata\prefs-1.js to C:\config\dr\browser\appdata\prefs.js
from C:\config\dr\browser\appdata\xpti.dat.tmp to C:\config\dr\browser\appdata\xpti.dat
from C:\config\dr\browser\appdata\compreg.dat.tmp to C:\config\dr\browser\appdata\compreg.dat
from C:\config\dr\browser\appdata\extensions-1.cache to C:\config\dr\browser\appdata\extensions.cache

Network activity:

Connects to:

'localhost':1037

Miscellaneous:

Searches for the following windows:

ClassName: 'MozillaUIWindowClass' WindowName: 'Add-ons'
ClassName: 'MozillaDialogClass' WindowName: 'Firefox - »ЦёґЙПґО»б»°'
ClassName: 'gFirefoxMessageWindow' WindowName: ''
ClassName: 'MozillaUIWindowClass' WindowName: 'virtual_visit_system_10-05-12 - Mozilla Firefox'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'MozillaDialogClass' WindowName: 'Firefox - ????????????'
ClassName: '' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial