Home Malware Programs Trojans Trojan.KillAV!rem

Trojan.KillAV!rem

Posted: November 23, 2010

Trojan.KillAV!rem is a malicious Trojan that may represent security risk for the compromised system or its network environment. Trojan.KillAV!rem contains a potentially unwanted adware program designed to deliver various advertisements to the infected system. Another program downloads files to the local computer that may represent security risk. Trojan.KillAV!rem also allows remote access to the compromised system and comes armed with a keylogger program that can capture all user keystrokes, including confidential details such usernames, passwords and credit card numbers. Remove Trojan.KillAV!rem immediately before it starts wreaking havoc on your system.

Aliases

Worm.Win32.AutoRun.bqjv (Kaspersky Lab)
Virus.Win32.AutoRun (Ikarus)
Win-Trojan/Fakesys.76800.G (AhnLab)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CommonDesktopDir%\Intennet Exploner.lnk
    2 %CommonPrograms%\Startup\TSPS.lnk
    3 %ProgramFiles%\Common Files\ips888.dll
    4 \explorer.exe
    5 c:\TSTP\winlogon.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}(Default) = "DiskDrive"[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
Loading...