Kasperkyya.exe – trojan Banload

Dmitry Sokolov recommends his nice removal tool: UnHackMe


UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

: Solved!
5 Stars (5 / 5)


Is the file Kasperkyya.exe located on your computer? Then your computer is infected.
We do suggest you should remove Kasperkyya.exe from your computer as soon as possible.
Kasperkyya.exe is Trojan/Backdoor.
Kill the process Kasperkyya.exe and remove Kasperkyya.exe from the Windows startup.

Malware Analysis of “GbpGSvc”
Executed: marcia002.exe
Removed: Kasperkyya.exe. Full path: C:\WINDOWS\Kasperkyya.exe

—————————————————————————————————————————-
Detected by UnHackMe:

Item Name: BTStacLrj
Author: Unknown
Related File: C:\WINDOWS\PLUGUINSCONTEINER.EXE
Type: Registry Run

Item Name: GbpGSvc
Author: casa
Related File: C:\WINDOWS\KASPERKYYA.EXE
Type: Registry Run

Item Name: Pluguinsconteiner.exe
Author: Unknown
Related File: C:\WINDOWS\PLUGUINSCONTEINER.EXE
Type: Running Processes

Item Name: Kasperkyya.exe
Author: casa
Related File: C:\WINDOWS\KASPERKYYA.EXE
Type: Running Processes

Removal Results: Success
Number of reboot: 1

—————————————————————————————————————————-
How to quickly detect malware presence?

Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BTStacLrj
Value: “C:\Windows\Pluguinsconteiner.exe”

Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\GbpGSvc
Value: “C:\Windows\Kasperkyya.exe”

Files:
C:\WINDOWS\Kasperkyya.exe
C:\WINDOWS\Pluguinsconteiner.exe
—————————————————————————————————————————-
Classification:

Antivirus Version Last Update Result
Kaspersky 9.0.0.837 2011.06.09 HEUR:Trojan-Downloader.Win32.Generic
Microsoft 1.6903 2011.06.09 TrojanDownloader:Win32/Banload.YC
NOD32 6194 2011.06.09 a variant of Win32/TrojanDownloader.Banload.QDY

—————————————————————————————————————————-

MD5 f1f528fee12f9e3ec409cfddad2da319

SHA1 7c8b979950f4ecbd72214d799d9a9cfe428c3bc9

SHA256 9c5ff7004ac5ba5835dcc4bf8c814acf76b787f9ed5e984caaf1d4f28f25f651

—————————————————————————————————————————-


Installation
When the program is executed, it creates the following registry subkeys and values:

———————————-
Keys added:5
———————————-
HKLM\Software\Microsoft\DownloadManager
HKCU\Software\Microsoft\Internet Explorer\TypedURLs
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

———————————-
Values added:3
———————————-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\BTStacLrj: “C:\Windows\Pluguinsconteiner.exe”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\GbpGSvc: “C:\Windows\Kasperkyya.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\ Embedded Web Browser from: http://bsalsa.com/: “”

———————————-
Files added:6
———————————-
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2B89.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF76EF.tmp
C:\WINDOWS\system32\COMCTL32.OCA
C:\WINDOWS\Kasperkyya.exe
C:\WINDOWS\Pluguinsconteiner.exe
C:\t\1

———————————-
Folders added:1
———————————-
C:\t

———————————-
Total changes:15
———————————-

—————————————————————————————————————————-
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com

UnHackMe removes malware invisible for your antivirus!

Free Download

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1. UnHackMe uses minimum of computer resources.

Testimonials:

Simon:
UnHackMe is a success where others have failed. We have used the software for sometime. Thank you for a great product, which actually works and we believe in the developers.

Bob:
The UnHackMe is a real program, no spyware or phish and works great and is easy to use. Enjoy!

Leave a Reply