Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 24.05.2007
auch bekannt als: Trojan-SMS.SymbOS.Viver.a [Kaspersky], Trojan-SMS.SymbOS.Viver.b [Kaspersky], Troj/Viver-A [Sophos], Troj/Viver-C [Sophos], Troj/Viver-B [Sophos]

Information:

SymbOS.Viver.A is a Trojan horse that sends SMS messages to a premium-rate number.

technische Details:

The Trojan is reportedly downloaded as one of the following files:
codecs_tool.sis
NetCompressor.sis
RulesViwer.sis


When the Trojan is executed, it displays one of the following messages depending on which minor variant was downloaded:
Codecs tool
NetCompressor
RulesViwer


It then drops the one of the following sets of files depending on which minor variant was downloaded:

C:\system\codecs\MadAudio.dll
C:\system\codecs\CoreMp4.dll
C:\system\codecs\codec_xvid.dll
C:\system\apps\CIDScanner\CIDScanner.app
C:\system\apps\CIDScanner\CIDScanner.rsc
C:\system\apps\CIDScanner\data.bin


or

[DRIVE LETTER]\system\apps\NetCompressor\NetCompressor.rsc
[DRIVE LETTER]\system\apps\NetCompressor\NetCompressor.app
[DRIVE LETTER]\system\apps\NetCompressor\NetCompressor.aif
[DRIVE LETTER]\system\apps\NetCompressor\Data.bin


or

C:\system\apps\RulesViver\photo.jfif
C:\system\apps\RulesViver\editor.dat
C:\system\apps\RulesViver\RulesViver.app
C:\system\apps\RulesViver\data.bin
C:\system\apps\RulesViver\RulesViver.aif
C:\system\apps\RulesViver\RulesViver.rsc

Once installed, the Trojan will send SMS messages to a premium-rate number.

[Link nur für registrierte Mitglieder sichtbar.]