|
|
|
VIRUS
NAME : QDel234
Trojan
Characteristics
This is a simple DOS
executable Trojan, which deletes critical system files from the victim
machine when run.
In at least one instance, the Trojan has been manually emailed to the
target as an attachment to an email in which the sender claims to have
hacked your web site. For example, an extract from an email bearing CMP.EXE:
To prove that I did a small HACK to an area in your site and I renamed
that "CMP". You can see that by viewing this attachment.
When executed on the victim machine a message is displayed to the user
and once the user presses a key, the following files are deleted from
the machine:
- *.ini and *.exe
from c:\windows\system
- *.dll and *.exe
from c:\windows
The above file paths
are hardcoded within the Trojan.
Symptoms
Missing system files from C:\Windows and C:\Windows\System.
|
|
|
