Registry Cleaner Geeks

June 23, 2009 7:25:07 AM

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

%System%\servises.exe

It then creates the following registry entries so that it runs every time Windows

starts:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\Current

  Version\Run\”servises” = “%System%\servises.exe”

• HKEY_CURRENT_USER\Software\Microsoft\Windows\Current

  Version\Policies\Explorer\Run\”servises” = “%System%\servises.exe”

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

  CurrentVersion\Run\”servises” = “%System%\servises.exe”

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\

  CurrentVersion\policies\Explorer\Run\”servises” = “%System%\

  servises.exe”

It also creates the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current

Version\services\”del” = “%SystemDrive%\[ORIGINAL THREAT FILE

NAME].exe”

It then attempts to download a file from the following URL:

[http://]91.207.4.122/spm/get_i[REMOVED]

Note: At the time of writing the above URL is inaccessible.

The downloaded file is saved as the following file:

%System%\_id.dat

The Trojan then attempts to download configuration information from

the following URL:

[http://]91.207.4.122/spm/page[REMOVED]

Note: At the time of writing the above URL is inaccessible.

The following email characteristics may be preconfigured by the

remote attacker:

• Address of sender
• Name of sender
• Address of recipient
• Name of recipient
• Message body

The Trojan then attempts to send spam emails from the compromised computer.

The Trojan may also perform the following actions:

• Download and execute files
• Send HTTP requests to preconfigured URLs

FREE SCAN:

Please click here for manual removal instructions.