Antispy storm installer

Started by miekiemoes , Nov 02 2007 01:20 AM

Please log in to reply

2 replies to this topic

#1 miekiemoes

Malware Killer Dog

Volunteer Security Advisor
4092 posts

Posted 02 November 2007 - 01:20 AM

Example thread/log:
http://www.lavasofts...showtopic=13573

The installer (vvgeowbv.exe) attached. (file is renamed to a vir extension)
This one runs under the HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon - Userinit value
plus it also creates a HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon - Userinit value

vvgeowbv.exe is responsible for dropping all these "dummy files" + a BHO (%System%\aivskurq.dll) + Changes desktop (%Windir%\default.htm) + displays fake alerts.

vvgeowbv.exe.zip 117.75K 3 downloads

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow!---My Blog---Follow me on Twitter.

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.
DO NOT POST your problem or log in someone elses thread, even though you are having the same problems. This to avoid confusion. Start a new thread instead and someone will help you asap.
Bumping your thread won't help to receive help in a faster way, this since we always look at the posts with 0 replies first. If you bump your thread, we assume that someone is already helping you, so your thread may be ignored.

Back to top

#2 LS Andy

Lavasoft Staff/Forum Overlord

Root Admin
1445 posts

Posted 02 November 2007 - 11:17 AM

Hi miekiemoes,

We picked this up this morning and added it to detection. Thanks for uploading!

Regards,

Andy
Lavasoft Research

Example thread/log:
http://www.lavasofts...showtopic=13573

The installer (vvgeowbv.exe) attached. (file is renamed to a vir extension)
This one runs under the HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon - Userinit value
plus it also creates a HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon - Userinit value

vvgeowbv.exe is responsible for dropping all these "dummy files" + a BHO (%System%\aivskurq.dll) + Changes desktop (%Windir%\default.htm) + displays fake alerts.

vvgeowbv.exe.zip 117.75K 3 downloads