Removed: csrcs.exe, ..\SYSTEM32\AUTORUN.INF
Malware: vvbxua.exe
—————————————————————————————————————————-
Removed:
C:\WINDOWS\system32\csrcs.exe
C:\WINDOWS\SYSTEM32\AUTORUN.INF
—————————————————————————————————————————-
Detected by UnHackMe:
Item Name: shell
Author: Unknown
Related File: Explorer.exe csrcs.exe
Type: System.ini
Item Name: csrcs
Author: Unknown
Related File: C:\WINDOWS\SYSTEM32\CSRCS.EXE
Type: Explorer Run
Item Name: csrcs.exe
Author: Unknown
Related File: C:\WINDOWS\SYSTEM32\CSRCS.EXE
Type: Detected using Heuristic Algorithm
Item Name: autorun.inf
Author: Unknown
Related File: C:\WINDOWS\SYSTEM32\AUTORUN.INF
Type: Detected using Heuristic Algorithm
Removal Results: Success
Number of reboot: 1
—————————————————————————————————————————-
Classification:
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| F-Secure | 9.0.15370.0 | 2010.04.12 | Gen:Trojan.Heur.AutoIT.0q3@bCcbCQcO |
| Kaspersky | 7.0.0.125 | 2010.04.12 | Packed.Win32.Klone.bj |
| Microsoft | 1.5605 | 2010.04.12 | Worm:AutoIt/Renocide.gen!A |
| NOD32 | 5019 | 2010.04.12 | Win32/Packed.Autoit.Gen |
—————————————————————————————————————————-
Additional information
File size: 854156 bytes
MD5 : 4511d13678bcaf724a82513687474c3d
SHA1 : 99302769e2ce7212cd26ce188eb2d4e429af0bd8
SHA256: af7d9e6299ae5811e798952d92f510e69ddb2ae5263da10ae68dfcc402088ce9
—————————————————————————————————————————-
Installation
When the program is executed, it creates the following registry subkeys and values:
———————————-
Keys added:3
———————————-
HKLM\Software\Microsoft\DRM\amty
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
———————————-
Values deleted:1
———————————-
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Cebtenz Svyrf\JvaENE\JvaENE.rkr: 24 00 00 00 06 00 00 00 00 D6 97 6D 85 AA CA 01
———————————-
Values added:7
———————————-
HKLM\Software\Microsoft\DRM\amty\ilop: “1″
HKLM\Software\Microsoft\DRM\amty\fix: “”
HKLM\Software\Microsoft\DRM\amty\fix1: “1″
HKLM\Software\Microsoft\DRM\amty\exp1: “408406541BC5BBE4DC197A2A0C46B9AFF2F90D96B151D7C7BCBD177641EE95F562E634D70EB70FB65FC8FBF0EC312619″
HKLM\Software\Microsoft\DRM\amty\dreg: “408406541BC5BBE4DC197A2A0C46B9ACF2F90D96B151D7C7BCBD177641EE95F562E634D70EB70FB65FC8FBF0EC31261C8626D05B1ED70CC881A48DA07A7E1A99″
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\csrcs: “C:\WINDOWS\system32\csrcs.exe”
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden: 0×00000000
———————————-
Values modified:1
———————————-
(-) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “Explorer.exe”
(+) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: “Explorer.exe csrcs.exe”
———————————-
Files added:3
———————————-
C:\Documents and Settings\Administrator\Local Settings\Temp\suicide.bat
C:\WINDOWS\system32\autorun.inf
C:\WINDOWS\system32\csrcs.exe
———————————-
Total changes:15
———————————-
—————————————————————————————————————————-
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
http://www.regrun.com
Recommended: UnHackMe anti-rootkit and anti-malware
Premium software: RegRun Security Suite (Good choice for removal and protection)
