TROJ_KILLMBR.DZ

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following files:

• %Program Files%\Hauri\SiteServer\vismsupdate\vms1014.zip - (contains OthDown.exe) detected as TROJ_KILLMBR.SM

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It drops the following non-malicious files:

• %Program Files%\Hauri\SiteServer\vismsupdate\update.zip

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Other System Modifications

This Trojan deletes the following files:

• %Program Files%\hauri\SiteClient\VrDown.exe
• %Program Files%\Hauri\SiteServer\VrPatch.exe
• %Program Files%\Hauri\SiteServer\ptUpdate.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\Software\VMS\
3.0\SiteServer\General
CenterServer = "hahaha"

(Note: The default value data of the said registry entry is "{Software default value}".)

HKEY_LOCAL_MACHINE\Software\VMS\
3.0\SiteServer\CfgInfo
ISMS = "56be65cd"

(Note: The default value data of the said registry entry is "{Software default value}".)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• vrfwsvc.exe
• vrptsvc.exe
• vrscan.exe
• hpcsvc.exe
• hsvcmod.exe
• vrfwsock.exe
• vrfwsvc.exe
• vrmonnt.exe
• vrrepair.exe
• vrmonsvc.exe
• hsvcmod.exe
• hpcsvc.exe

NOTES:

It drops file to a certain security software update folder. Therefore, when the said software updates, the dropped file (TROJ_KILLMBR.SM) is executed.