Avenger.gen is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious way. Trojans do not replicate or spread to other computers. Avenger.gen is compressed using the executable packer and its file size is 292,864 bytes. Avenger.gen drops the following files on the hard drive: - C:\WINDOWS\system32\install\server.exe (292864 bytes)
It also changes Windows registry: - Creates value "Policies"="C:\WINDOWS\system32\install\server.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run".
- Creates value "Policies"="C:\WINDOWS\system32\install\server.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run".
It creates the following mutex to ensure only one instance is running: _x_X_UPDATE_X_x_. _x_X_PASSWORDLIST_X_x_. _x_X_BLOCKMOUSE_X_x_. ***MUTEX***. It also contains anti-debugging code, is executed every time Windows starts.
|
