W32/Kolweb.A!tr

Analysis

This trojan has the capability to connect to the following URL:

• http://aidintime.com/money/
• http://bascowater.com/money/
• http://camberageflex.com/money/
• http://collarsaround.com/money/
• http://emorningmoss.net/money/
• http://etightstrings.net/money/
• http://logiose.com/money/
• http://moltenmagnet.net/money/
• http://money.cafreedom.com/money/
• http://netremoteline.com/money/
• http://treestompertime.net/money/

It may create a new Key in the registry under Software\money.
It may also hook itslelf into the following registry:

• Software\Microsoft\Windows\CurrentVersion\Run
• Software\Microsoft\Windows\CurrentVersion\RunOnce
• Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\

And has any of the following strings in the file:

• Sorry, FirstDelay is not reached yet. Waiting ...
• Sorry, PopUpSlayer installed, stop show ads...
• Sorry, adDelay is not reached yet. Waiting ...
• Sorry, all ads already served, waiting time interval
• Sorry, borndelay is not reached yet, Redirect stopped, waiting...
• Sorry, borndelay is not reached yet, waiting...

This trojan may use any of the followiing names:

• b01927.exe
• b01960.exe
• c00460.exe
• c00826.exe
• jqzc.dll
• noname.dat

Recommended Action

To manually clean this trojan, you may follow this short procedure:

• Remove any registry entries that points to the virus files.
• Restart the machine in safemode, then delete the virus files.
• Block the url/sites.