McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Troj/Vidlo-Q (Sophos)

• TROJ_DLOADER.RY (Trend)

Characteristics

-- Update September 11th 2005 --
A recent spamming has been reported intended to download a password stealer which is proactively detected as PWS-Banker.

--

This trojan was likely created by the same author as the Downloader-AAP.B trojan .

Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.

This downloader variant tries to download a file called "100.exe" from five different servers and "hhtz.exe" from another.

As the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behavior of these new binaries altered - possibly with every user infection.

This trojan was spammed on July 4th, 2005 in Germany using the following email format:

From: "Deutsche Telekom AG" Rechnung-Online@t-com.net (forged)
Subject: Telekom
Body: (may be contained in an attachment named message.htm) 

Attachment: Rechnung.pdf.exe

Symptoms

When run, this trojan copies itself to the WINDOW (%WinDir%) directory and creates a registry run key to load itself at system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
  Run "winldr" = C:\WINDOWS\Rechnung.pdf.exe

The trojan attempts to download files from the following sites:

• www.hairkrafts.net
• www.kandid.ru
• telecard.com.ua
• allboards.com.ua
• www.orima.ru
• www.npfpk.ru

Method of Infection

This downloader trojan was mass spammed on July 4, 2005.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• Troj/Vidlo-Q (Sophos)

• TROJ_DLOADER.RY (Trend)

Characteristics

Characteristics -

-- Update September 11th 2005 --
A recent spamming has been reported intended to download a password stealer which is proactively detected as PWS-Banker.

--

This trojan was likely created by the same author as the Downloader-AAP.B trojan .

Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.

This downloader variant tries to download a file called "100.exe" from five different servers and "hhtz.exe" from another.

As the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behavior of these new binaries altered - possibly with every user infection.

This trojan was spammed on July 4th, 2005 in Germany using the following email format:

From: "Deutsche Telekom AG" Rechnung-Online@t-com.net (forged)
Subject: Telekom
Body: (may be contained in an attachment named message.htm) 

Attachment: Rechnung.pdf.exe

Symptoms

Symptoms -

When run, this trojan copies itself to the WINDOW (%WinDir%) directory and creates a registry run key to load itself at system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
  Run "winldr" = C:\WINDOWS\Rechnung.pdf.exe

The trojan attempts to download files from the following sites:

• www.hairkrafts.net
• www.kandid.ru
• telecard.com.ua
• allboards.com.ua
• www.orima.ru
• www.npfpk.ru

Method of Infection

Method of Infection -

This downloader trojan was mass spammed on July 4, 2005.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A