Home Malware Programs Worms Win32/Yeltminky

Win32/Yeltminky

Posted: March 14, 2012

Threat Metric

Threat Level: 5/10
Infected PCs: 56
First Seen: March 14, 2012
Last Seen: November 1, 2019
OS(es) Affected: Windows

Win32/Yeltminky is a computer worm that circulates by copying itself on all available drives and creating an autorun.inf file to execute that copy. Win32/Yeltminky makes system changes that specify the occurrence of this infection. Once executed, Win32/Yeltminky makes a copy of itself in one of the certain locations on the infected PC system. Win32/Yeltminky may also replicate itself to a secondary location on the system. The file name used, and the secondary location Win32/Yeltminky replicates to, is supplied as part of configuration data stored in the Win32/Yeltminky file. Win32/Yeltminky also drops a DLL component. The file name is randomly created and the file extension may change. The DLL component may then add a driver component with a random name. Once the driver is loaded, the file is deleted. Win32/Yeltminky modifies the Windows registry to assure that its copy runs each time you start Windows.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



SafeDrvse.exe File name: SafeDrvse.exe
Size: 95.23 KB (95232 bytes)
MD5: a331755b41502c356826649cb8d1ef78
Detection count: 98
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 15, 2012
SafeDrvse.exe File name: SafeDrvse.exe
Size: 115.71 KB (115712 bytes)
MD5: 151ac60e12d7a7a98908befe9ce50c8f
Detection count: 95
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 15, 2012
file.exe File name: file.exe
Size: 118.78 KB (118784 bytes)
MD5: 263d019dd8c6ae68cd73714ead701291
Detection count: 93
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 15, 2012
%UserProfile%\<random file name>.drv File name: %UserProfile%\<random file name>.drv
File type: Device Driver
Mime Type: unknown/drv
Group: Malware file
%UserProfile%\<random file name>.fon File name: %UserProfile%\<random file name>.fon
Mime Type: unknown/fon
Group: Malware file
%UserProfile%\<file name>.exe File name: %UserProfile%\<file name>.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%UserProfile%\auto.exe File name: %UserProfile%\auto.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%UserProfile%\jmfxs.drv File name: %UserProfile%\jmfxs.drv
File type: Device Driver
Mime Type: unknown/drv
Group: Malware file
%UserProfile%\<random file name> File name: %UserProfile%\<random file name>
Group: Malware file
%windir%\fonts\evngj.fon File name: %windir%\fonts\evngj.fon
Mime Type: unknown/fon
Group: Malware file
%windir%\fonts\<file name>.fon File name: %windir%\fonts\<file name>.fon
Mime Type: unknown/fon
Group: Malware file
%windir%\fonts\<random file name>.fon File name: %windir%\fonts\<random file name>.fon
Mime Type: unknown/fon
Group: Malware file
%ProgramFiles%\common files\auto.exe File name: %ProgramFiles%\common files\auto.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run = "SysAnti" = "%ProgramFiles%\common files\sysanti.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "auto" = "%ProgramFiles%\common files\auto.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Related Posts

Loading...