|
Description:
Trend Micro threat researchers post findings and analyses on various threats in real-time at the Malware Blog. Users can find more information about this specific threat here. |
To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This Trojan may be dropped by TROJ_SINOWAL.CB.
It looks for the bootable drive of the affected system. Once found, it copies the original Master Boot Record (MBR) and saves it to another location in the hard disk. It then modifies the MBR by inserting its malicious code.
It also saves some of its malicious code in another portion of the hard disk. As a result, data of the files saved in the said portion are replaced.
It creates a registry entry to enable its automatic execution at every system startup.
This Trojan also drops a rootkit component on the affected system. The said component modifies certain sectors of the infected hard disk. It then protects these sectors from read and write operations from antivirus or security software.
For additional information about this threat, see:
Solution
Technical Details
Description created: May. 2, 2008 5:22:05 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
