Trojan.Agent.Delf.RHO( Generic.ImROBOT, Trojan-Im.Win32.Agent.ah, W32/Agent.AK!tr )
SINTOMAS: %WINDIR%\system32\yahooui.exe %WINDIR%\seocfg.exe %WINDIR%\upd1234.exe %WINDIR%\vbn.sdf The malware also installs the following clean files: %WINDIR%\system32\yahooauth2.dll %WINDIR%\system32\ssleay32.dll %WINDIR%\system32\libeay32.dll The virus will also modify the following registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell by appending the following strings to it: %WINDIR%\system32\yahooui.exe %WINDIR%\seocfg.exe The presence of the following subkeys: HKLM\SOFTWARE\Yahoo\smartkey and HKLM\SOFTWARE\Yahoo\lidl Which contains the values: Count USER PASS DESCRIPCIÓN TÉCNICA: The malware spreads through links sent in instant messages on Yahoo!Messenger by other infected users. It tries to convince the target user that the message is legitimate by adding friendly phrases to trick the user into clicking the provided link. The used messages are:sa intrii sa imi zici ce parere ai ca sigur recuonsti personaju ;) o cunosti? :))) chiar vroiam sa te apelez, ai virusi si imi trimiti tot felu de mailuri ia programu asta sa il scoti ca l-am avut si eu sau daca nu intra pe http://www.[link removed].ro Afla cine te are pus la invizibil sau la ignore cu un singur click chiar si persoanele care sunt offline http://[link removed].blogspot.com ce faci? Super tare!!!!!!!! http://[link removed].blogspot.com Depending on the version of the malware, if the target user replies, the virus will check for the presence of the following keywords in the reply and sends an automatic answer according to what is found:
Once the user clicks the link he is usually directed to a web site or blog containing an embedded movie which requests the user to download a codec that is actually the malware. When the user executes the downloaded file, a progress bar briefly appears and the following files are installed without user intervention: %WINDIR%\system32\yahooui.exe %WINDIR%\system32\yahooauth2.dll %WINDIR%\system32\ssleay32.dll %WINDIR%\system32\libeay32.dll It also places itself in the startup list by appending the following string to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell %WINDIR%\system32\yahooui.exe After the next system startup, the yahooui.exe process creates the following registry key: HKLM\SOFTWARE\Yahoo\lidl It waits for the user to sign in to Yahoo!Messenger and saves the username and password inside the values USER and PASS in the HKLM\SOFTWARE\Yahoo\lidl key. The virus will then try to spread by sending spam messages to the contacts in the user's contact list. The malware also downloads the following files: %WINDIR%\seocfg.exe %WINDIR%\upd1234.exe %WINDIR%\vbn.sdf seocfg.exe and upd1234.exe are malware files, detected as Trojan.Spy.Banker.ACFQ, which tries to trick the user into accessing phishing sites related to banking. The vbn.sdf file contains the links which are sent in the spam messages. INSTRUCCIONES DE LIMPIEZA: Please let BitDefender disinfect your files.ANALIZADO POR: Livadariu Mihai Andrei, virus researcher |