Trojan.Downloader.Bredolab.CJ - Virus Micr. Word Icon

This malware has a word document icon in oder to lure the user into opening it.

It copies itself in %Programs%\Startup\rarype32.exe in order to start along with Windows and removes traces of installation on the machine by deleting the original file which generated the infection.

Trojan.Downloader.Bredolab.CZ has 2 components:
- packed main executable
- downloader (which is never written on disk directly but is injected into other processes)

The trojan creates a custom unique mutex in order to check if the system is already infected. Also it inject itself into a running version of "explorer.exe"

Trojan.FakeAV.XP - Fake Antivirus Malware

The user receives messages of false infection on his computer in order to make him activate (buy) the fake antivirus product. The rogue antivirus resembles the program suite from the operating system and on the installation of the malware the user can notice the following image :

Also the malware creates the following file %CommonAppData%\[RandomString]\[RandomString].exe. Another noticeable sign of infection is the folder %AppData%\Enterprise Suite.

* A typical path for %CommonAppData% is C:\Documents and Settings\All Users\Application Data.

* A typical path for %AppData% is C:\Documents and Settings\[UserName]\Application Data.

Trojan.TDss.ZR - complex malware

This is a complex malware that performs the following actions upon execution:

- creates a copy of itself in “%windir%\System32\spool\PRTPROCS\W32X86\” directory under the name “[random-number].tmp” and modifies the headers of the copy by setting the attributes related to a dll;
- creates a driver file in “%windir%\Temp\" directory under the name “[random-number].tmp”
- creates a copy of itself in “%Temp%” directory under the name “[random-number].tmp”
- Injects code in “spoolsv.exe” process in order to run with higher privileges, code which will load the dropped driver.
- The injected code will also communicate with different servers as: https://h4356***.cn, https://h9237***.cn, https://212.117.174.***, making the computer part of a botnet network and from now on it can download files, execute them and do many other malware related actions.

Trojan.PWS.Onlinegames.KDBI - Trojans Inject

In order to hide his actions, when is first run, the trojan will inject its code into the memory of Explorer.exe using low-level methods and a remote thread pointing to this zone will be started. This code (executed by Explorer) will be responsible to inject into all running processes a dll dropped by the trojan (%USERPROFILE%\Local Setings\Temp\cvasd0.dll).

The injected DLL contains two components. An online games password stealer (with the targets: KnightOnline, Metin2, AgeOfConan,TheLordOfTheRings,Maple...). Another embedded DLL (ANTIVM.dll) will try to disable some known security solutions usually by stopping the update services modules (Liveserv.exe, vsupdate.exe, Update.exe, AVP.exe, avgupd.exe).