Home Malware Programs Malware Sus.ComPack

Sus.ComPack

Posted: June 26, 2009

Sus.ComPack is a malware that sometimes goes by the names Sus.ComPack.C and Sus.ComPack.J, and is officially categorized as a file that displays suspicious behavior. Typically Sus.ComPack is downloaded unknowingly from malicious websites or peer-to-peer networks. Once active on your PC, Sus.ComPack causes decreased system speed, changes in Internet settings, annoying pop-up ads to appear, registry files to go missing, and unknown programs showing up in the process list.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 CMServer.exe
    2 CommFort_server.exe
    3 ida.exe
    4 PCTAV.exe
    5 RAMMedic.exe
    6 RegMech.exe
    7 Update.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ RAM MedicHKEY..\..\..\..{RegistryKeys}RUNNING PROGRAM\CMServer.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ CommFort serverHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Internet Download AcceleratorHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ PCTAVAppHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ RegistryMechanicHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows Updates

Related Posts

Loading...