Virus

W32/Agent.0D65!tr.bdr

Analysis


  • It drops the following files:
    • undefinedProgram Filesundefined\Common Files\MSSoap\Binaries\Resources\1033\MicrosoftSoap1.02.814.0.exe
    • undefinedProgram Filesundefined\Common Files\SpeechEngines\Microsoft\TTS\1033\WindowsTMMicrosoft.exe
    • undefinedProgram Filesundefined\Common Files\SpeechEngines\Microsoft\TTS\1033\WindowsTMSystem.exe
    • undefinedProgram Filesundefined\Common Files\VMware\Drivers\Virtual Printer\TPOG3\i386\ThinPrinttpprn761951.exe
    • undefinedProgram Filesundefined\Common Files\VMware\Drivers\vmci\vmciVMware.exe
    • undefinedProgram Filesundefined\MSN Gaming Zone\Windows\Zonebackgammon.exe

  • It adds the following registry:
    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    • value: SysinternalsSysinternals
    • data: C:\Documents and Settings\[User]\Desktop\036CBDAC.exe

    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    • value: Zonebackgammon
    • data: undefinedProgram Filesundefined\MSN Gaming Zone\Windows\Zonebackgammon.exe

    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    • value: MSSOAPRMicrosoft
    • data: undefinedProgram Filesundefined\Common Files\MSSoap\Binaries\Resources\1033\MicrosoftSoap1.02.814.0.exe

    • key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    • value: OperatingSystem
    • data: undefinedProgram Filesundefined\Common Files\SpeechEngines\Microsoft\TTS\1033\WindowsTMMicrosoft.exe


Recommended Action

    FortiGate Systems
  • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
    FortiClient Systems
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.