Sonicwall Signatures


Go to All Categories list.

Vesser.A is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. Vesser.A is compressed using the TELOCK executable packer and its file size is 87,728 bytes. Vesser.A drops the following files on the hard drive:
  • C:\WINDOWS\SYSTEM32\sms.exe (87728 bytes)
It also changes Windows registry:
  • Creates value "KernelFaultChk"="c:\sample.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
It creates the following mutex to ensure only one instance is running: uu33WEEu. Y&T. It also is executed every time Windows starts.

Relevant Information