Trojan.PS1.POWLOAD.JKP

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %User Temp%\{String1}\{String2}

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

信息窃取

它收集下列数据:

• Machine GUID

其他(tā)详细信息

该程序执行以下操作(zuò)：

• where:
  
  • String1
  • any of the following directories found on %User Temp%
  • String2
  • any of the following filename of the files found on %User Temp%
• It attempts to connect to an unknown malicious site.
• However, URL is not specified.

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)