Win32/Filecoder [Threat Name] go to Threat
Win32/Filecoder.G [Threat Variant Name]
| Category | trojan,worm |
| Size | 90112 B |
| Aliases | Trojan.Win32.VB.dsm (Kaspersky) |
| Trojan:Win32/Vorus.BH (Microsoft) | |
| Generic.dx!mvl (McAfee) |
Short description
Win32/Filecoder.G is a trojan that overwrites the content of certain files with its own data. To restore files to their original state the user is requested to send an e-mail to a specified address in exchange for a password/instructions.
Installation
When executed the trojan copies itself in the following locations:
- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\File1.exe
- C:\Documents and Settings\%username%\Start Menu\Programs\Startup\File1.exe
- C:\Documents and Settings\%username%.%computername%\Start Menu\Programs\Startup\File1.exe
This causes the trojan to be executed on every system start.
Payload information
Win32/Filecoder.G is a trojan that overwrites the content of certain files with its own data.
The trojan searches local drives for files with the following file extensions:
- .doc
- .mdb
- .ppt
- .txt
- .xls
When the trojan finds a file matching the search criteria, it creates its duplicate.
The file name and extension of the newly created file is derived from the original one.
The following string is prepended:
- "Hid_"
.
The following text is written to found file:
Other information
The trojan copies itself into the root folders of removable drives using the following name:
- File1.exe (90112 B)
The trojan creates the following files:
- C:\WINDOWS\chk.txt
- C:\WINDOWS\listOfExcells.txt
- %drive%\chk.txt