Name:

TrojanDownloader.FakeVimes.a

Added:

October 18, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When TrojanDownloader.FakeVimes.a is executed, it performs the following activities:

After execution, it drops the following files:

%Appdata%\ab5a93\VDab5_287.exe
%Appdata%\mrtvapeqeaqonld\FRed32.dll
%Appdata%\mrtvapeqeaqonld\SmartGearvo.exe
%Appdata%\mrtvapeqeaqonld\spoof.avi
%Appdata%\mrtvapeqeaqonld\vo.exe

It creates/modifies the following registry entries:
LocalServer32 = %Appdata%\ab5a93\VDAB5_~1.EXE
HKLM\SOFTWARE\Classes\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}

FDP = %Appdata%\ab5a93\VDab5_287.exe"