Home Malware Programs Keyloggers VirTool.Win32.FireJoiner

VirTool.Win32.FireJoiner

Posted: April 21, 2011

VirTool.Win32.FireJoiner is a harmful keylogger program that can take over all user keystrokes involving personal details, such username, password, credit card number, etc. VirTool.Win32.FireJoiner circulates through questionable p2p and freeware applications or through pornographic content websites. VirTool.Win32.FireJoiner will download files to the computer without a victim's consent which will lead to security risk. VirTool.Win32.FireJoiner can even enable the attacker obtain remote access to the affected computer. Remove VirTool.Win32.FireJoiner immediately using a reputable anti-spyware program.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\wap.exe
    2 %System%\drivers\trs.sys
    3 %System%\sysdba.bat
    4 %System%\sysdba.exe
    5 %Windir%\ERRO
    6 c:\avenger.txt
    7 c:\cleanup.exe
    8 c:\kill.txt
    9 c:\TITI.EXE

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USER\EnableLUAHKEY_CURRENT_USER\wapHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PELODLOHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PELODLO\0000HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PELODLO\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fagtafHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pelodloHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pelodlo\EnumHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pelodlo\SecurityHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PELODLOHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PELODLO\0000HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pelodloHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pelodlo\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PELODLOHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PELODLO\0000HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PELODLO\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fagtafHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pelodloHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pelodlo\EnumHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pelodlo\Security
Loading...