|Detected||May 22 2008 17:58 GMT|
|Released||May 26 2008 08:15 GMT|
|Published||Sep 03 2008 07:36 GMT|
This Trojan downloads another program and launches it on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 49152 bytes in size. It is written in C++.
Once launched, the Trojan deletes the following parameter from the system registry:
It then sends a request to the following site:
It sends the request shown below to the domain name which it receives in reply:
At the time of writing, the following name was being used:
In answer to the request, the Trojan gets the current version of the "VaccinePro" utility and compares it to the version which is installed on the victim machine by getting data from the following system registry key:
If the utility has not been previously installed on the victim machine, the Trojan creates the following directory:
It then downloads a file called "VaccPD.exe" to this directory from the following link:
This file is 73728 bytes in size.
In order to ensure that the Trojan is launched automatically each time the system is booted, it registers its executable file in the system registry:
The Trojan then creates and runs the following special system registry key:
[HKCU\Software\VaccinePro] "code1" = "winwin" "code2" = "" "updateurl" = "*****vaccinepro.co.kr" "controllerVersion" = "1.1" "Version" = "1.1"
It then downloads the following file:
This file will be saved as "VaccPU.exe" to the directory created by the Trojan:
– the file is 701952 bytes in size
The Trojan then sends a request to the following address:
In reply it gets a list of links from which it will download files. At the time of writing, the list was as shown below:
http://*****vaccinepro.co.kr/version/bin/VaccP.dll http://*****vaccinepro.co.kr/version/bin/vpd.dll http://*****vaccinepro.co.kr/version/bin/uninst_vcpr.exe http://*****vaccinepro.co.kr/version/bin/VaccPD.dat http://*****vaccinepro.co.kr/version/bin/VaccPP.dat http://*****vaccinepro.co.kr/version/bin/VaccPS.exe http://*****vaccinepro.co.kr/version/bin/VaccP.exe http://*****vaccinepro.co.kr/version/bin/VaccPP.exe
These files are saved under the following names:
The Trojan then ceases running.
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VaccP" = "%Program Files%\VaccinePro\VaccPD.exe" [HKCU\Software\VaccinePro]
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.