Content
Generic.dx!gfb!3AEA288C07DB
- Type
- Trojan
- SubType
- Discovery Date
- 10/29/2009
- Length
- Minimum DAT
- 5786 (10/29/2009)
- Updated DAT
- 5786 (10/29/2009)
- Minimum Engine
- 5.2.00
- Description Added
- 10/29/2009
- Description Modified
- 11/02/2009 7:51 AM (PT)
Tab Navigation
Characteristics
This is a generic detection for Trojans. Trojan behavior can be found in various malware families like "downloader", "dropper", "backdoor", "password stealer", etc. They are standalone applications that might call other malware or infect your machine on executing.
They can act in various ways to steal your data, private information, or resources.
It enables backdoor functionalities by connecting to a remote site and performing actions as programmed by a remote attacker.
The following registry is used:
- HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Active Setup\Installed Components\{04D76A86-B759-FCF9-9BF3-BFB1C189EAC8}
"Stubpath" = "File Path\dllhost.exe"
The above mentioned registry activates on every reboot, and the Trojan variants register themselves.
It establish connection with the remote host 61.196.[removed] using the port 80.
The following mutex has been created:
It creates a mutex with the name "!VoqQ.I4"
Symptoms
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc. Certain known variants were also known to be installed via web exploits.
Removal
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a Trojan detection. Unlike viruses, Trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
File Properties
- File Name : dllhost.exe
- Size : 8,984 bytes
- MD5 : 3AEA288C07DB42761E7BD83431FFE1D4
- SHA1 : EBFACF13962C9AFE32DB58B6AB4849DEEDD39C4D
Aliases
- Kaspersky : Trojan.Win32.Pincav.jbs
- Microsoft : Backdoor:Win32/Poison.M
- Symantec : Backdoor.Ciadoor
- Ikarus : Packed.Win32.Klone
Characteristics
Characteristics -
This is a generic detection for Trojans. Trojan behavior can be found in various malware families like "downloader", "dropper", "backdoor", "password stealer", etc. They are standalone applications that might call other malware or infect your machine on executing.
They can act in various ways to steal your data, private information, or resources.
It enables backdoor functionalities by connecting to a remote site and performing actions as programmed by a remote attacker.
The following registry is used:
- HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Active Setup\Installed Components\{04D76A86-B759-FCF9-9BF3-BFB1C189EAC8}
"Stubpath" = "File Path\dllhost.exe"
The above mentioned registry activates on every reboot, and the Trojan variants register themselves.
It establish connection with the remote host 61.196.[removed] using the port 80.
The following mutex has been created:
It creates a mutex with the name "!VoqQ.I4"
Symptoms
Symptoms -
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc. Certain known variants were also known to be installed via web exploits.
Removal -
Removal -
All Users:
Use current engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
