This Trojan downloads other files via the Internet and launches them for executionon the victim machine without the user’s knowledge or consent. It isapproximately 2KB in size. It is written in Visual Basic Script. Once launched, the Trojan injects its code into the memory of processes whichhave the following unique identifier in the system registry: {BD96C556-65A3-11D0-983A-00C04FC29E36} The Trojan then uses a vulnerability in Internet Explorer to download a filefrom the following URL: http://www.d***j.com/down/my.dll At the moment of writing, this link was not working. This file will be saved to the Windows temporary directory as “vmmreg32.dll”: %Temp%\vmmreg32.dll This file will then be registered in the system as an OLE object, using thefollowing command: regsvr32.exe /s vmmreg32.dll If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram: - Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
- Delete the following file:
%Temp%\vmmreg32.dll - Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).
Printed From:http://www.viruslist.com/en/viruses/encyclopedia?virusid=137868
Similar Virus/Threat >>
Trojan-Downloader.VBS.Psyme.f
This Trojan downloads other programs via the Internet without the knowledgeor consent of the user and launches them on the victim machine. The programis a Visual Basic scenario. It is 1,898 bytes...
Trojan-Downloader.VBS.Psyme.fc
This Trojan program exploits a vulnerability in Microsoft Internet Explorerto launch other Trojan programs on the victim machine. It is an HTML page; whenthe page is loaded, other malicious code...
Trojan-Downloader.VBS.Small.ca
This Trojan downloads other files via the Internet and launches them for executionon the victim machine without the user’s knowledge or consent. It is5 456 bytes in size. It is written in...
Trojan-Downloader.VBS.Psyme.ci
This Trojan downloads other files via the Internet and launches them for executionon the victim machine without the user’s knowledge or consent. It isapproximately 1KB in size. It is...
|
