Home Malware Programs Trojans Trojan.Win32.Larchik.v

Trojan.Win32.Larchik.v

Posted: November 5, 2009

Trojan.Win32.Larchik.v is a malicious trojan horse that may represent a serious security risk for an infected computer or network environment. Trojan.Win32.Larchik.v, also known as Trojan.Win32.VB, uses a program that automatically downloads files to the local computer. These files are identified as threats on PC scans and the user is urged to have them removed by purchasing useless anti-spyware programs. Do not be fooled by these fake warnings. Have Trojan.Win32.Larchik.v removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\27a.exe
    2 %System%\5.exe
    3 %System%\IEShortcut.exe
    4 %System%\tubiao111111.exe
    5 %Windir%\game.ico
    6 %Windir%\MM.ico
    7 %Windir%\StormBox.ico
    8 %Windir%\Temp\syccom\Setup.exe
    9 %Windir%\Temp\syccom\Source.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\WinRAR SFXHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\DefaultIconHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\ShellHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\ShellFolderHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\??(&R)HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\??(&R)\CommandHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\DHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\D\CommandHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\OpenHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}\Shell\Open\CommandHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{5B3CF2C3-BB2E-B124-4351-1B3D6CB6CD21}
Loading...