Home Malware Programs Trojans Trojan.Klovbot

Trojan.Klovbot

Posted: October 19, 2011

Threat Metric

Threat Level: 9/10
Infected PCs: 5
First Seen: October 19, 2011
OS(es) Affected: Windows

Trojan.Klovbot is a Trojan infection that was created by hackers to steal information from the infected computer. Trojan.Klovbot spreads via email or drive-by download. Once executed, Trojan.Klovbot copies itself to certain location. Trojan.Klovbot modifies the hosts file and generates the registry so that it could run each time a PC user starts Windows. Trojan.Klovbot then connects to a remote server, downloads a malicious version of the hosts file, and saves it to a particular location. The modified hosts file redirects the victim from legitimate websites to dubious sites. Remove Trojan.Klovbot immediately after detection.

Aliases

Trj/CI.A [Panda]W32/Dapato.BTFU!tr [Fortinet]Win32.SuspectCrc [Ikarus]Dropper/Win32.Dapato [AhnLab-V3]TR/Dropper.MSIL.Gen [AntiVir]BackDoor.Blackshades.4 [DrWeb]UnclassifiedMalware [Comodo]Trojan-Dropper.Win32.Dapato.btfu [Kaspersky]Win32:Dropper-gen [Drp] [Avast]Trojan.Klovbot [Symantec]Artemis!6F8F19DBE0FC [McAfee]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



Carta-PDF.exe File name: Carta-PDF.exe
Size: 32.76 KB (32768 bytes)
MD5: dcc56442f04ec61ffd3c93bb187e4a22
Detection count: 27
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: October 20, 2011
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FlasshPlayerV11.1.37.18.exe File name: FlasshPlayerV11.1.37.18.exe
Size: 245.76 KB (245760 bytes)
MD5: 6f8f19dbe0fcb7993b7765623ba59ae5
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: December 17, 2012
%Windir%\csrcs.exe File name: %Windir%\csrcs.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CurrentFolder%\Postales.exe File name: %CurrentFolder%\Postales.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CurrentFolder%\Postal_Gusanito.exe File name: %CurrentFolder%\Postal_Gusanito.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CurrentFolder%\EasyBot.exe File name: %CurrentFolder%\EasyBot.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%CurrentFolder%\MicroServIp.exe File name: %CurrentFolder%\MicroServIp.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\"Microsofts" = "%Windir%\csrcs.exe"
Loading...