|Detected||Feb 05 2009 13:19 GMT|
|Released||Feb 05 2009 18:23 GMT|
|Published||Sep 29 2010 10:27 GMT|
This Trojan installs other programs to the victim machine without the knowledge or consent of the user. It is a Windows application (PE EXE file). It is 5308 bytes in size. It is packed using PE_Patch or UPack. The unpacked file is approximately 66 KB in size. It is written in C++.
After launching, the Trojan extracts a file from its body and saves it in the system under the following name:
%WinDir%\Downloaded Program Files\spoolv.exe(3740 bytes; detected by Kaspersky Anti-Virus as "Exploit.Win32.IMG-WMF.fk")
The extracted exploit file can download a file from the Internet through a link sent as a parameter. To do so, the exploit uses the vulnerability "MS08-067"
The extracted file is then launched for execution with the following parameter:
http://m.w***c8.com/mm.exeAt the time of writing, an HTML page of 1142 bytes in size was downloaded from this link.
The Trojan then ceases running.
If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:
%WinDir%\Downloaded Program Files\spoolv.exe
MD5: 83CB7770DB348AD1BE1F76ED77602DDB SHA1: EE460175D8EF5B8B5079DAC9D7186126095B4851
Trojan-Dropper programs are designed to secretly install malicious programs built into their code to victim computers.
This type of malicious program usually save a range of files to the victim’s drive (usually to the Windows directory, the Windows system directory, temporary directory etc.), and launches them without any notification (or with fake notification of an archive error, an outdated operating system version, etc.).
Such programs are used by hackers to: