Mal/Spy-H

Category: Viruses and Spyware Protection available since:11 Mar 2010 12:10:40 (GMT)
Type: Malicious behavior Last Updated:11 Mar 2010 12:10:40 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Examples of Mal/Spy-H include:

Example 1

Other vendor detection

Avira
TR/Malex.339968.E
Kaspersky
Trojan.Win32.Cosmu.xmi

Runtime Analysis

Copies Itself To
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\ctfmon.exe
Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\startModules.vbs
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\install_timestamp
  • c:\Documents and Settings\test user\Local Settings\Temp\repair.vbs
Registry Keys Created
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
    ...
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc
    Application
    MSOFFICE.exe
  • HKCU\Software\Classes\Applications\MSOFFICE.exe\shell\open\command
    (Default)
    "C:\DOCUME~1\support\LOCALS~1\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe""%1"
  • HKCU_Classes\Applications\MSOFFICE.exe\shell\open\command
    (Default)
    "C:\DOCUME~1\support\LOCALS~1\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe""%1"
Processes Created
  • c:\windows\system32\reg.exe
  • c:\windows\system32\wscript.exe
DNS Requests
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBia.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBib.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBic.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBid.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBie.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBif.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBig.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBih.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBii.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBij.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBik.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBil.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBim.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBin.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBio.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBip.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBiq.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBir.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBis.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBit.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBiu.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBiv.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBiw.r0f.org
  • THWtcH9vNICkNUhzOBA.A--BBBBBBFBBBBBBBBBix.r0f.org

Example 2

Other vendor detection

Avira
TR/Malex.339968.E.2
Kaspersky
Trojan.Win32.Cosmu.xmj

Runtime Analysis

Copies Itself To
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\spoolsv.exe
Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\install_timestamp
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\startModules.vbs
  • c:\Documents and Settings\test user\Local Settings\Temp\repair.vbs
Registry Keys Created
  • HKCU_Classes\Applications\MSOFFICE.exe\shell\open\command
    (Default)
    "C:\DOCUME~1\support\LOCALS~1\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe""%1"
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
    _w32repair
    C:\DOCUME~1\support\LOCALS~1\Temp\repair.vbs
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc
    Application
    MSOFFICE.exe
Processes Created
  • c:\windows\system32\reg.exe
  • c:\windows\system32\wscript.exe
DNS Requests
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBia.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBib.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBic.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBid.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBie.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBif.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBig.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBih.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBii.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBij.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBik.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBil.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBim.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBin.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBio.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBip.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBiq.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBir.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBis.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBit.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBiu.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBiv.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBiw.r0f.org
  • THWtcH9vNICkNUV4OhA.A--BBBBBBFBBBBBBBBBix.r0f.org

Example 3

Other vendor detection

Avira
TR/Malex.339968.E.1
Kaspersky
Trojan.Win32.Cosmu.xmh

Runtime Analysis

Copies Itself To
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\spoolsv.exe
Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\startModules.vbs
  • c:\Documents and Settings\test user\Local Settings\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\install_timestamp
  • c:\Documents and Settings\test user\Local Settings\Temp\repair.vbs
Registry Keys Created
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc
    Application
    MSOFFICE.exe
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
    _w32repair
    C:\DOCUME~1\support\LOCALS~1\Temp\repair.vbs
  • HKCU_Classes\Applications\MSOFFICE.exe\shell\open\command
    (Default)
    "C:\DOCUME~1\support\LOCALS~1\Temp\_w32backup.{645FF040-5081-101B-9F08-00AA002F954E}\MSOFFICE.exe""%1"
Processes Created
  • c:\windows\system32\reg.exe
  • c:\windows\system32\wscript.exe
DNS Requests
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBia.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBib.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBic.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBid.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBie.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBif.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBig.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBih.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBii.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBij.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBik.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBil.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBim.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBin.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBio.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBip.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBiq.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBir.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBis.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBit.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBiu.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBiv.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBiw.r0f.org
  • THWtcH9vNICkNUN4OhA.A--BBBBBBFBBBBBBBBBix.r0f.org

download Try Sophos products for free
Download now

© 1997 - 2012 Sophos Ltd. All rights reserved. Legal Privacy