TROJ_RBOT.FOP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}\{random folder 6}\{random}.dat

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

It creates the following folders:

• %All Users Profile%\{random folder 1}
• %All Users Profile%\{random folder 1}\{random folder 2}
• %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}
• %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}
• %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}
• %All Users Profile%\{random folder 1}\{random folder 2}\{random folder 3}\{random folder 4}\{random folder 5}\{random folder 6}

(Note: %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}lo.co.cc
• http://server1.{BLOCKED}2369.codisk.com