  |
|
         |
 |
|
 |
|
alias: TR/Kolweb.j.7, Trojan.Durvil, Adware.Zenosearch
length: 95744 bytes (Kolweb.Y), 150016 bytes (Kolweb.Z) date: 2007 february range: alacsony Further information
It can be installed by a trojan downloader from the site makemouse.com.
It works like an adware, but it is a trojan because of the way of the installation process. It copies itself to the Windows System folder as file drivera.exe and into the temporary file folder as ~ds39990.tmp. It drops a file into the Windows System folder : drivera.dll. Both are detected by VirusBuster, the installer as Trojan.Kolweb.Z, the dropped file as Trojan.Kolweb.Y. It creates some Registry entries : HKEY_CLASSES_ROOT\CLSID\{54698A2F-2247-4538-82FC-2B5443D66945}\{Defaults} HKEY_CLASSES_ROOT\CLSID\{54698A2F-2247-4538-82FC-2B5443D66945}\ThreadingMode HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{54698A2F-2247-4538-82FC-2B5443D66945}\{Defaults} HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{54698A2F-2247-4538-82FC-2B5443D66945}\ThreadingMode HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54698A2F-2247-4538-82FC-2B5443D66945} Disinfection (Windows 2000) 1. Stop Internet Explorer 2. regsvr32 /u \winnt\system32\drivera.dll 3. Remove infected files Disinfection (Windows XP) 1. Stop Internet Explorer 2. regsvr32 /u \windows\system32\drivera.dll 3. Remove infected files |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
