Home Malware Programs Trojans Rustock SpamBOT

Rustock SpamBOT

Posted: July 15, 2009

Rustock SpamBOT is a trojan virus known for the affect it has on a PC's ability to use the e-mail services and other critical computer options. Being infected with Rustock SpamBOT will result in the limited scope of Internet services available to you, with a number of essential computer functions not being accessible.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\rhcnotj0e5eg\database.dat
    2 %Program Files%\rhcnotj0e5eg\license.txt
    3 %Program Files%\rhcnotj0e5eg\MFC71.dll
    4 %Program Files%\rhcnotj0e5eg\MFC71ENU.dll
    5 %Program Files%\rhcnotj0e5eg\msvcp71.dll
    6 %Program Files%\rhcnotj0e5eg\msvcr71.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software NotifierHKEY_LOCAL_MACHINE\SOFTWARE\rhcnotj0e5egHKLM\Software\Microsoft\38C826F1HKLM\Software\Microsoft\38C826F1#38c826f1HKLM\Software\Microsoft\38C826F1#38c88b71HKLM\Software\Microsoft\38C826F1#38c8e294HKLM\Software\Microsoft\38C826F1#VersionHKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\7723c7bbHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\7723c7bbHKLM\system\controlset001\services\2b963c37
Loading...