Virus.Jeefo Trojan Information
|| - Alias: Nobof, Trojan.Win32.Nobof
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.
Virus.Jeefo detection is provided both for the Virus.Jeefo stand-alone, first-generation executable and for a host application, which is infected with Virus.Jeefo.
Virus.Jeefo infects the host application in three steps. The virus:
Imports the hosts resources.
Encrypts data that represents the host application with the stripped resources.
Appends this particular data to the newly constructed executable.
If Virus.Jeefo detects that it is an infected host application, it will do the following:
Reconstruct the first-generation Virus.Jeefo executable.
Drop it as Svchost.exe into the %Windows% folder.
Then, the dropped file will be run with the program parameter that specifies an infected application, which has dropped and run Svchost.exe.
It will quit.
When svchost.exe (the first-generation Virus.Jeefo executable) runs, it checks whether the program parameter specifies an infected application. If it detects that another application dropped and ran it, and that the application contains the following infection marker at a fixed file offset:
Hidden Dragon virus. Born in a tropical swamp.
it will perform the following actions:
Waits until the infected host quits so that its file is unlocked.
Reconstructs the original host by detaching appended data, decoding it, and moving the resources back to it.
Runs the reconstructed executable that does not contain Virus.Jeefo code.
In other words, when an application infected with Virus.Jeefo is executed, the dropped W32.Jeefo first-generation program repairs it.
||process: svchost.exe: MD5 Hash: d7087dc8386182fda70...
process: svchost.exe: MD5 Hash: e3c13b6556d5636b745..
Top Trojan Visited Pages:
Anti Netbus - 3477 visits
Tro.Downloader.loadadv - 589 visits
Netbus Fucker - 294 visits
Server Sockets - Alias: Backdoor.Sockets, Sockets23 - 284 visits
SMF.166.Batch - 271 visits
Enable Regedit - 252 visits
Trojan.BankerSpy - 236 visits
Java.ClassLoader.Dummy.d - 234 visits
Lamping - 187 visits
Silver Surfer Trojan - 150 visits
Random Trojan Pages:
Aids Trojan - Alias: Aids Information 2, Cyborg, Trojan.AidsInfo.b
Nobof Trojan - Alias: Nobof, Trojan.Win32.Nobof