Trojan.Downloader.Swizzor.EM( Trojan.LopAd, Win32/Lop.BI, Adware.Win32.Lop.Ai )
SYMPTOMS: It is possible to have multiple instances of Internet Explorer in memory.
It is also possible to have strangly named directories under %AppData% (\Documents and Settings\%UserName%\Application Data) containing many downloaded malware files with .exe extension. Another symptom is to have malware files under %TMP% with names bis[randomnumber].exe (like c:\temp\bis14.exe). TECHNICAL DESCRIPTION: The trojan determines the path of Internet Explorer using the system registry. After that, the trojan checks, if it is running already in the process context of Internet Explorer. If not, then a new instance of Internet Explorer is created and the virus loads and executes itself under the Internet Explorer process as a library.
The trojan dowloads other malware from randomly constructed URLs with the form http://[random]/bins/int/[removed]. The files are downloaded into the %TMP% folder with .TMP extension, but are later moved to %AppData% directory with random names based on a dictionary (like %AppData%\PollFindSite\SupportBike.exe) and executed. If the injection of code into Internet Explorer fails, then the virus checks for command line arguments, like:
Removal instructions: Please let BitDefender delete your files.ANALYZED BY: Sándor LUKÁCS, BitDefender virus researcher |
