Trojan.AVKill.37788

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\vssadmin.exe' Delete Shadows /Quiet /All
'<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /Quiet /All

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Windows Media Player\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Windows NT\Pinball\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\NetMeeting\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Outlook Express\readme_liesmich_encryptor_raas.txt
%WINDIR%\$NtUninstallWIC$\spuninst\readme_liesmich_encryptor_raas.txt
%WINDIR%\readme_liesmich_encryptor_raas.txt
<Auxiliary element>
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Movie Maker\Shared\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\Messenger\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\readme_liesmich_encryptor_raas.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme_liesmich_encryptor_raas.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\readme_liesmich_encryptor_raas.txt
%APPDATA%\Microsoft\Address Book\readme_liesmich_encryptor_raas.txt
%APPDATA%\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
C:\Far2\Documentation\eng\readme_liesmich_encryptor_raas.txt
C:\Far2\Documentation\rus\readme_liesmich_encryptor_raas.txt
%HOMEPATH%\Templates\readme_liesmich_encryptor_raas.txt
C:\Far2\Addons\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\readme_liesmich_encryptor_raas.txt
<Current directory>\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\readme_liesmich_encryptor_raas.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\readme_liesmich_encryptor_raas.txt
C:\Documents and Settings\Default User\Templates\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\readme_liesmich_encryptor_raas.txt
%ALLUSERSPROFILE%\DRM\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Services\readme_liesmich_encryptor_raas.txt
C:\Far2\readme_liesmich_encryptor_raas.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\readme_liesmich_encryptor_raas.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\readme_liesmich_encryptor_raas.txt