Home / malware

PDF

Banload.AQP

First posted on 13 September 2006.
Source: SecurityHome

Aliases :

There are no other names known for Banload.AQP.

Explanation :

This malware downloads and executes a file from certain websites.

This malware uses an Icon of an Image file.

Upon execution, this malware connects, downloads, and executes a file from the follwing websites:

http://bedtrader.com/tmp/fotos/[REMOVED]/verao1.scr


Detected as Trojan-Spy.Win32.Banker.axc

http://snwn.lss.gov.cn/img/fotos/[REMOVED]/verao1.scr


Detected as Trojan-Spy.Win32.Banker.av

Solution :

To manually disinfect standalone malware (backdoors, worms, trojans, etc.) it's usually enough to delete all infected files from a computer and to restart it. Active malware files are usually locked by operating system so different disinfection approaches are required for different operating systems.
Please note that manual disinfection is a risky process, so it is recommended only for advanced users.

If Windows 95, 98 and ME operating system is used, it is recommended to restart a computer from a bootable system diskette and to delete an infected file from command prompt. For example if a malicious file named ABC.EXE is located in Windows folder, it is usually enough to type the following command at command prompt:

DEL C:\WINDOWS\ABC.EXE

and to press Enter. After that an infected file will be gone. If Windows NT, 2000 or XP is used, a malicious file has to be renamed with a different extension (for example .VIR) and then a system has to be restarted. After restart a renamed malicious file will no longer be active and it can be easily deleted manually.

Windows System Restore Issues

If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore feature of these operating systems might save an infected file into the special folder and copy it back to a hard drive it every time it's been renamed or deleted.
It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in the future, if any crash or incompatibility issue occurs.

Last update 13 September 2006

 

TOP