Troj/Kilt-A

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MDM
C:\Arquivos de Programas\Internet Explorer\MDM.exe

and delete it if it exists.

Close the registry editor.

Troj/Kilt-A is an mIRC Trojan which attempts to download an mIRC script from a remote website and link it into an existing mIRC installation.

When run the Trojan will attempt to create the following folders into which it will copy itself:

C:\Arquivos de Programas\Acessorios\BACKUP\SYSTEM\MSCFG.exe
C:\Arquivos de Programas\Internet Explorer\MDM.exe

The downloaded mIRC script is placed in the folder:

C:\Arquivos de Programas\Internet Explorer\Script02.mrc

Troj/Kilt-A will create the following registry entry so as to auto-start on computer reboot:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MDM
C:\Arquivos de Programas\Internet Explorer\MDM.exe

If mIRC is installed then its configuration file (mirc.ini) will have the following entry added to invoke the Trojan script:

[rfiles]
n<number>=C:\Arquivos de Programas\Internet Explorer\Script02.mrc

Troj/Kilt-A may attempt to carry out DDoS type attacks when instructed by a remote attacker.