Internet threat level: 1
Home→Descriptions→Trojan.Win32.KillFiles.lm
Trojan.Win32.KillFiles.lm
| Detected | Nov 02 2006 17:06 GMT |
| Released | Nov 02 2006 17:06 GMT |
| Published | Jan 11 2007 13:22 GMT |
Payload
Removal instructions
Technical Details
This Trojan has a malicious payload. It is a Windows PE EXE file. The file is 368 128 bytes in size. áàéò. It is not packed in any way. It is written in Borland Delphi.
Payload
Once launched, the Trojan will delete autoexec.bat from the C: root directory:
C:\autoexec.bat
The Trojan will then attempt to delete explorer.exe from the Windows directory:
%WinDir%\explorer.exe
Removal instructions
- Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
- Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.