Name:

Trojan.crypt.zk

Added:

September 5, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Trojan.crypt.zk is executed, it performs the following activities:

After execution, it drops the following files:

%AppData%\Iuqeqm.exe
%AppData%\Microsoft\Protect\Credentials\wmpnetvk.exe
%AppData%\Microsoft\Protect\Credentials\taskhostt.exe
%AppData%\Microsoft\Protect\Credentials\wmpnetvk.gzp

It creates/modifies the following registry entries:

Microsoft® Windows® Operating System = "%AppData%\Microsoft\Protect\Credentials\taskhostt.exe"
HKU\Software\Microsoft\Windows\CurrentVersion\Run

Microsoft® Windows® Operating System = "%AppData%\Microsoft\Protect\Credentials\taskhostt.exe"
HKU\Software\Microsoft\Windows\CurrentVersion\Run

Iuqeqm = "%AppData%\Iuqeqm.exe"
HKU\Software\Microsoft\Windows\CurrentVersion\Run

This infection has Rootkit functionality keeping "%AppData%\Iuqeqm.exe" hidden and hooks some various user mode functions.