Constructor.MicroJoiner - Spyware Detector

Spyware free software spyware removal Anti Spyware software free spyware check adware spyware remover anti virus download

Home/ Spyware Encyclopedia / Constructor.MicroJoiner

Constructor.MicroJoiner Technical Details

Category

Constructor

Discovered

2/13/2008 15:39:00 PM

Modified

7/16/2008 12:44:00 PM

Threat Level

High

Description

Virus writers use constructor utilities to create new malicious programs and Trojans. It is known that constructors to create macro-viruses and viruses for Windows are in existence. Constructors can be used to generate virus source code, object modules and infected files.Some constructors come with a user interface where the virus type, objects to attack, encryption options, protection against debuggers and disassembles, text strings, multimedia effects etc. can be chosen from a menu.

Summary

The hosts file was updated with the following url-to-ip mappings: n/a
The following http urls were started:
www.cartoon-disney-porn.com
Generated smtp traffic: n/a
Connection(s) established with remote IRC Server: n/a
The following hidden entries created: n/a
The following internet connection was established: n/a

When the Constructor is executed, it creates the following files:

Name	Version	Publisher	Signature (MD5)	File Size (in Bytes)
..\startup\msgplus.exe	3.70.0.146	patchou		7321088
..\common files\joipor.vxd			5f944bf091a6c10d4b6b834aca958445	36864
..\sysconfig\concealer.exe			c78b291706b02f8273aa171edb78a45a	32175
..\sysconfig\nostealth.exe			dd4ffe7356efc8bdadf656669913e140	51609
..\sysconfig\sysdiag.exe			a76c833b691875084d3ea94116ad1e44	708726
..\tasker\tasker.exe			edd4d2ab2e87107652f99b238a84c465
..\tasker\taskerservice.dll			cc449c2a6b5a0ceca0bfd81851f4d902
..\temp\1.exe			91c0fb8bde9c3eeab68fbcd5e5e10e36	314368
..\temp\1.exe			15efba9fd1506c164933c234b81d1436	727301
..\temp\1.exe			5ad9da7e32f69384b844ccb354b35960	765791
..\temp\1microjoiner.exe			6025c62598c121ce1663e0418ca35077	14848
..\temp\20060410som.exe	4.0.7.0	Macromedia, Inc.	d3b719f9829ea835558b287f4058fbde	614131
..\temp\22.exe			5863d4ae11149ea8e37fe8dff5df6ade	1231680
..\temp\ab.exe			fccd34f00f08054ace1ffc209bfb74b7	1084639
..\temp\abcd.exe			5b9f151571a62d7a2bc340cba9a93918	1206316
..\temp\abcd.exe			7940744fa70d526d43edfd19eca4c38c	1242668
..\temp\aimbot.exe	1.0.0.0	BACKKHOA	fe5f35c3d9c67df0c89ff6f69765085c	98304
..\temp\asb.exe	1.0.0.0		1777d25144a44c48e644077fe26a07aa	93606
..\temp\avltool.exe	2.0.0.1		d9f5069e7d4a6f779e6bcd59968bc17a	188416
..\temp\aziz.exe			80149d5f35cc5b4af96d0a0790b9470d	108075
..\temp\backdoor.exe	2.0.0.2	des	6cff0ef55faf502e3e9a66e5e84b4002	294912
..\temp\beast 2.06.exe			4f0d972648e21a2381e480f068610578	824832
..\temp\beholdertool76.exe			523a638569af6026e5e69b24cbb54fb1	466944
..\temp\biffbot2.exe	2.0.0.0		af1bbc39747c06cb88fb6d2c573f0b7a	497152
..\temp\black32.dll			61a633f39ec5af681b15ef7bb5170cec	6656

When the Constructor is executed, it creates the following Registry entries:

•	..\431334302401486614
•	..\software\microsoft\internet explorer\main\default_page_url\"http://mm.18semm.com"
•	..\software\microsoft\internet explorer\main\search page\"http://mm.18semm.com"
•	..\software\microsoft\internet explorer\main\start page\"http://mm.18semm.com"
•	..\software\microsoft\windows\currentversion\run\"lsasscompiler"
•	..\software\microsoft\windows\currentversion\run\"msdrc"
•	..\software\microsoft\windows\currentversion\run\"msdxtsrv32"
•	..\software\resturn
•	..\software\classes\clsid\{9a8ee521-e2a7-48af-b183-85a18a21e18d}
•	..\software\classes\clsid\{ed9cc19d-baed-4180-8c72-6b0a52e86fde}
•	..\software\classes\clsid\{eefa59f6-cc78-4a27-9549-1d054e08eb71}
•	..\software\microsoft\84fd8446\"84fd8446"
•	..\software\microsoft\internet explorer\main\start page\"http://mm.18semm.com"
•	..\software\microsoft\pchealth\pchsvc\datacollection\"20080524012759.000000-000"
•	..\software\microsoft\windows nt\currentversion\image file execution options\conime.exe
•	..\software\microsoft\windows nt\currentversion\image file execution options\xxx.exe
•	..\software\microsoft\windows nt\currentversion\svchost\"nwvwyo"
•	..\software\microsoft\windows nt\currentversion\svchost\"zgrpby"
•	..\software\microsoft\windows\currentversion\run\"%PROFILE%\local settings\temp\"deepunfreezeru1.6.exe "
•	..\software\microsoft\windows\currentversion\run\"%PROFILE%\local settings\temp\"dopebot.exe "
•	..\software\microsoft\windows\currentversion\run\"%PROFILE%\local settings\temp\"hook18free.dll "
•	..\software\microsoft\windows\currentversion\run\"%PROFILE%\local settings\temp\"onelager_buocvaodoi.exe "
•	..\software\microsoft\windows\currentversion\run\"%SYSDIR%\"222.exe "
•	..\software\microsoft\windows\currentversion\run\"%SYSDIR%\"amigo3.exe "
•	..\software\microsoft\windows\currentversion\run\"%SYSDIR%\"eventhack.exe "

Recommendation to remove Constructor.MicroJoiner

Spyware Detector can remove Constructor.MicroJoiner, and thousands of other Spyware definitions, automatically and instantly. Click here to download Spyware Detector and scan for free.

	Personalized e-Mail support by our Research Team. You send an "Export Log" report to us, we then add new definition and you eliminate spyware found on YOUR PC in the next Live Update. So, not only do you benefit but the whole community enjoys the feedback.

	Speed up your computer and increase browsing performance by deleting Spyware & Adware

	Enjoy continuous protection and security with frequent spyware definition updates so you never have to worry about new threats and outdated software.

	Surf the web with confidence knowing your online activities aren't being tracked, and your confidential data is secure from prying eyes.

Search Threats

Testimonials

Information Desk

	Spyware & Adware Categories we scan

	List of Spyware & Adware we remove


	Submit a Threat Submit a threat to be reviewed by our research team Submit a Threat