trojan downloader: Rootkit.Win32.Agent.b

Risk level: Medium

virus symptoms

The sample is a downloader which was developed by “VC”, the size of “78,848 bytes” , icon “
“, Virus extension” exe “, the virus main purpose is to download and run the exe list of designated sites, to Slow down quickly infected the operating system, and turn the computer back door, the computer user’s security at risk.
After the user’s computer was infected, there will be computer and network running slow, there caused all kinds of viruses affecting user privacy disclosure and the phenomenon of computer users, even lead to not enter the operating system.

Infected OS

Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission

Download tools to disseminate

Manual solutions (only for those who download, do not apply to the downloading of viruses):

1, manually delete the following files

% Sytemroot% \ system.exe

2, manually delete the following Registry

Key: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
Value: system
Data:% Sytemroot% \ system.exe

Variable declaration:

% SystemDriver% system where the disk partition, usually “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

The virus creates files:

% ProgramFiles% \ rav \ CDriver.sys
% ProgramFiles% \ rav \ CDriver.inf
% SystemRoot% \ xxxxxx.dll (random name)
% SystemRoot% \ xxxxxx.dll (random name)

Virus delete the files:

The virus itself
% ProgramFiles% \ rav \ CDriver.sys
% ProgramFiles% \ rav \ CDriver.inf

Virus to create the registry:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ system

Access the network:

http://sh16 .*****. com: 8080/sh16/d.txt
1: http://sh16 .*****. com: 8080/ok.exe
1: http://sh16 .*****. com: 8080/a02.exe
1: http://sh16 .*****. com: 8080/a05.exe
1: http://sh16 .*****. com: 8080/a17.exe
1: http://sh16 .*****. com: 8080/a31.exe
1: http://sh16 .*****. com: 8080/a14.exe
1: http://sh16 .*****. com: 8080/a4.exe
1: http://sh16 .*****. com: 8080/a03.exe
1: http://sh16 .*****. com: 8080/a09.exe
1: http://sh16 .*****. com: 8080/a07.exe
1: http://sh16 .*****. com: 8080/a10.exe
1: http://sh16 .*****. com: 8080/a24.exe
1: http://sh16 .*****. com: 8080/a13.exe
1: http://sh16 .*****. com: 8080/a30.exe
1: http://sh16 .*****. com: 8080/a04.exe
1: http://sh16 .*****. com: 8080/a01.exe
1: http://sh16 .*****. com: 8080/a08.exe
1: http://sh16 .*****. com: 8080/a19.exe
1: http://sh16 .*****. com: 8080/a11.exe
1: http://sh16 .*****. com: 8080/a25.exe
1: http://sh16 .*****. com: 8080/a16.exe
1: http://sh16 .*****. com: 8080/a21.exe
1: http://sh16 .*****. com: 8080/a27.exe
1: http://sh16 .*****. com: 8080/a12.exe
1: http://sh16 .*****. com: 8080/a23.exe
1: http://sh16 .*****. com: 8080/a26.exe
1: http://sh16 .*****. com: 8080/a15.exe
1: http://sh16 .*****. com: 8080/a18.exe
1: http://sh16 .*****. com: 8080/a20.exe
1: http://sh16 .*****. com: 8080/a22.exe
1: http://sh16 .*****. com: 8080/a28.exe
1: http://sh16 .*****. com: 8080/a29.exe
1: http://sh16 .*****. com: 8080/a06.exe
1: http://sh16 .*****. com: 8080/a1.exe
1: http://sh16 .*****. com: 8080/a2.exe
1: http://sh16 .*****. com: 8080/a3.exe
1: http://sh16 .*****. com: 8080/a5.exe
1: http://sh16 .*****. com: 8080/b16.exe
1: http://sh16 .*****. com: 8080/k16.exe
1: http://sh16 .*****. com: 8080/tj.exe
1: http://sh16 .*****. com: 8080/down.exe