TROJ_GBVL.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

• %Program Files%\pipi\HttpDownLoad.exe
• %Desktop%\¿áÎÒÒôÀÖºÐ.lnk
• %User Profile%\Quick Launch\¿áÎÒÒôÀÖºÐ.lnk
• %Desktop%\i¿´Ó°ÊÓ.lnk
• %Desktop%\PPLive ÍøÂçµçÊÓ.lnk
• %User Profile%\Quick Launch\PPLive ÍøÂçµçÊÓ.lnk
• %Start Menu%\Programs\PPLive\жÔØ PPLive.lnk
• %Desktop%\PPS°ÂÔËÊÓƵֱ²¥°æ.lnk
• %Desktop%\Coopen.lnk
• %User Profile%\Quick Launch\PPS°ÂÔËÊÓƵֱ²¥°æ.lnk
• %User Profile%\Quick Launch\Coopen.lnk
• %User Startup%\PPS.lnk
• %Start Menu%\Programs\PPS °ÂÔËÊÓƵֱ²¥°æ.lnk
• %Start Menu%\Programs\PPStream\жÔØ PPStream.lnk
• %Common Startup%\¹È¸è½ðɽ´Ê°ÔºÏ×÷°æ.lnk
• %Start Menu%\Programs\¹È¸è½ðɽ´Ê°ÔºÏ×÷°æ\жÔسÌÐò.lnk
• %Desktop%\²é¿´UUSeeÍøÂçµçÊÓ½ÚÄ¿µ¥.lnk
• %User Profile%\Quick Launch\UUSee ÍøÂçµçÊÓ.lnk
• %Start Menu%\Programs\UUSee ÍøÂçµçÊÓ\жÔØUUSee ÍøÂçµçÊÓ.lnk
• %Desktop%\ÔÓÖ¾¶©ÔÄÆ÷.lnk
• %Desktop%\Á˽âÍøÖ·´óÈ«.lnk
• %Start Menu%\Programs\Zcom ÔÓÖ¾¶©ÔÄÆ÷\жÔØ.lnk
• %Desktop%\·çÐÐÍøÂçµçÓ°.lnk
• %User Profile%\Quick Launch\·çÐÐÍøÂçµçÓ°.lnk
• %Start Menu%\Programs\·çÐÐ\жÔØ ·çÐÐÍøÂçµçÓ°.lnk
• %Desktop%\²¥°Ô²¥·ÅÆ÷.lnk
• %Desktop%\²¥°Ô¿áÓ°.url
• %Desktop%\ÀÖ²¥µçÓ°¿â.lnk
• %Desktop%\ÖÐÒ×ä¯ÀÀÆ÷1166ÌØÖÆ°æ.lnk
• %User Profile%\Quick Launch\²¥°Ô.url
• %Common Startup%\²¥°Ô.lnk
• %Start Menu%\Programs\²¥°Ô\жÔØ ²¥°Ô.lnk
• %User Profile%\Quick Launch\ÖÐÒ×ä¯ÀÀÆ÷1166ÌØÖÆ°æ.lnk
• %Desktop%\ƤƤÃâ·Ñ¸ßÇåÓ°ÊÓ.lnk
• %User Profile%\Quick Launch\ƤƤ²¥·ÅÆ÷.lnk
• %Start Menu%\Programs\ƤƤ\жÔØ PIPI.lnk
• %Desktop%\¿ì¿ì½Ý.lnk
• %User Startup%\¿ì¿ì½Ý.lnk
• %Desktop%\Ìǹûä¯ÀÀÆ÷.lnk
• %User Profile%\Quick Launch\Ìǹûä¯ÀÀÆ÷.lnk
• %Desktop%\ÀÖÊÓÍøÂçµçÊÓ.lnk
• %Program Files%\KWMUSIC\uninstall.exe
• %Program Files%\PPLive\uninst.exe
• %Program Files%\PPStream\uninst.exe
• %Program Files%\Kingsoft\PowerWord Lite\Uninstall.exe
• %Program Files%\uusee\uninstuusee.exe
• %Program Files%\Common Files\uusee\uninst.exe
• %System Root%\Zcom\uninst.exe
• %Program Files%\Funshion Online\Funshion\Uninstall.exe
• %Program Files%\Boobaa10\unins000.exe
• %Program Files%\pipi\unins000.exe
• %Program Files%\¿ì¿ì½Ý\uninst.exe
• %Program Files%\TangGuo\unins000.exe
• %Program Files%\Letv\P2P\Uninstall.exe
• %Program Files%\Letv\P2P\Uninst.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.. %Common Startup% is the system's shared Startup folder, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\7FKey(ÍêÃÀÖÕ½á°æ).exe
• %System%\7FKey(ÍêÃÀÖÕ½á°æ).exe
• %User Temp%\CPAAD.MDB

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}m.com/CPAAD.MDB

This report is generated via an automated analysis system.