W32/Oficla.WK!tr - Released Jun 27, 2010 - Last Updated Sep 23, 2010
|
Alias/esTrojan.Win32.Oficla.wk (KAV) |
Visible Symptoms
- The following files exist:
- %Temp%\[Number].tmp
- %System%\hyli.igo
- Possible firewall alert that an executable program is attempting to connect to the Internet.
|
Detailed Analysis
W32/Oficla.WK!tr is a DLL file issued by the Sasfis botnet. A detailed description and analysis of the Sasfis botnet can be viewed at the following URL: Sasfis Detailed Description.
Technical Details
- It drops the following files:
- %Temp%\{number}.tmp
- %System%\hyli.igo
- It adds the following registry entries:
- key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- value: Shell
- data: Explorer.exe rundll32.exe hyli.igo atkhnt
|
Recommended ActionFortiGate Systems
- Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
FortiClient Systems
- Quarantine/delete files that are detected and replace infected files with clean backup copies.
|
