|
This particular threat is reported to be a kind of adware, similar to Adware.Loadscc which is an adware program that generates funds to malware authors by contacting service provider to confirm the success of other malware installation. Alias: W32.Voterai [Symantec]
The major indication of its infection are as follows
C:\Documents and Settings\[UserName]\Desktop\Raila Odinga.gif C:\Windows\Temp\New Folder (2)\Raila Odinga.exe C:\Windows\Temp\New Folder (2)\smss.exe C:\Windows\System32\drivers\Raila Odinga.exe C:\Windows\System32\drivers\smss.exe C:\Windows\Temp\New Folder (2)\Raila Odinga.exe C:\Windows\Temp\New Folder (2)\smss.exe C:\Windows\Temp\nskA.tmp\System.dll C:\Windows\Temp\nst4.tmp\System.dll C:\Windows\Temp\nst8.tmp\System.dll C:\Windows\Temp\nsy2.tmp\System.dll C:\Windows\Temp\nsy6.tmp\System.dll C:\Documents and Settings\[UserName]\Start Menu\Programs\Startup\Raila Odinga.lnk C:\Documents and Settings\[UserName]\Start Menu\Programs\Startup\smss.lnk
C:\Windows\wininit.ini Process found in the Task Manager Raila Odinga.exe (located in Temp folder and drivers folder) smss.exe (located in Temp folder and drivers folder) Added registry value - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- (Default) = "%System%\drivers\raila odinga"
You can see the Threatexpert report on this link.
(Reprinted with permission from ThreatExpert)
|