Internet threat level: 1
Home→Descriptions→Trojan.Win32.KillFiles.cgi
Trojan.Win32.KillFiles.cgi
| Detected | Apr 01 2011 17:42 GMT |
| Released | Apr 12 2011 07:44 GMT |
| Published | Sep 09 2011 09:29 GMT |
Payload
Removal instructions
Technical Details
A trojan program designed to delete components of the security software Gbuster plugin for Internet Explorer. Implemented in the form of an NT kernel mode driver. 5120 bytes. Written in C++.
Payload
After launching, the trojan tries to delete the following files:
\Device\HarddiskVolume1\Arquivos de Programas\gin15\c1.txt \Device\HarddiskVolume1\Arquivos de Programas\gin13\c2.txt \Device\HarddiskVolume1\Arquivos de Programas\gin13\c3.txt \Device\HarddiskVolume1\Arquivos de Programas\gin13\c4.txt \Device\HarddiskVolume1\Arquivos de Programas\GbPlugin\gbiehcef.dll \Device\HarddiskVolume1\Program Files\Gbplugin\gbieh.dll \Device\HarddiskVolume1\Program Files\GbPlugin\gbiehuni.dll \Device\HarddiskVolume1\Program Files\GbPlugin\gbiehcef.dll \Device\HarddiskVolume1\Program Files\GbPlugin\Gbpsv.exe \Device\HarddiskVolume1\Program Files\GbPlugin\gbiehabn.dll \Device\HarddiskVolume1\Arquivos de Programas\GbPlugin\Gbpsv.exe \Device\HarddiskVolume1\Arquivos de Programas\Gbplugin\gbieh.dll \Device\HarddiskVolume1\Arquivos de Programas\GbPlugin\gbiehabn.dll \Device\HarddiskVolume1\Arquivos de Programas\GbPlugin\gbiehuni.dll
Removal instructions
If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:
- Delete the original trojan file (its location on the infected computer will depend on how it got onto the computer).
- Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).
MD5: 06A1E65EDE9E171877B91B614E0C1FAD
SHA1: 2F16E7A8ECDE746459EC1AE86321E0A33D973E4B
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.