Profil Virus Mail Skinner

[Qrembiezs]

Mailskinner

Risk Assessment: Home Low | Corporate Low
Date Discovered: 12/2/2005
Date Added: 12/2/2005
Origin: Unknown
Length: Varies
Type: Trojan
Subtype: Spyware
DAT Required: 4642

Ditulis dengan bahasa Visual C++.
di eksekusi

Code:

%ProgramFiles%\MailSkinner\

dan

Code:

%windows%\system32\

Code:

msegcompid.dll, msclock32.jpg and axsetup.dll

infected Registry

Code:

HKEY_CURRENT_USER\Software\epk_extr
HKEY_CURRENT_USER\Software\exts
HKEY_CURRENT_USER\Software\exts\{8E09CB72-3143-4414-A1C2-63E9C0438472}
HKEY_CURRENT_USER\Software\MailSkinner
HKEY_CURRENT_USER\Software\Microsoft\Installer
HKEY_CURRENT_USER\Software\Microsoft\Installer\Features
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\
96FF640DA68D6C24EAF73B276C0844D6
HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\
589C136F0E6FCEA4FAC5EFBABA79F5A0
HKEY_CLASSES_ROOT\CLSID\{180B4EE9-1795-4429-9651-F17A6515726D}
HKEY_CLASSES_ROOT\Interface\{0A089E22-5736-4092-B3F8-3F0D5F345482}
HKEY_CLASSES_ROOT\OutlookAddin.Addin
HKEY_CLASSES_ROOT\OutlookAddin.Addin.1
HKEY_CLASSES_ROOT\TypeLib\{5BAD7FAE-81F0-4439-8C1A-3E8907998047}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\
OutlookAddin.Addin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
UpgradeCodes\589C136F0E6FCEA4FAC5EFBABA79F5A0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\{D046FF69-D86A-42C6-AE7F-B372C680446D}

dan dia mencoba utk mengkontak apakah ada ver yg terbaru
http://www.security-udpater.com