TrojanDropper:Win32/Lisfel.A Description

TrojanDropper:Win32/Lisfel.A is a Trojan that distributes other Lisfel components on the compromised machine. When installed on the targeted computer system, TrojanDropper:Win32/Lisfel.A makes system changes by adding malevolent files and registry entries. TrojanDropper:Win32/Lisfel.A modifies the specific registry entry so that it can load its downloaded component every time you boot up Windows. TrojanDropper:Win32/Lisfel.A may invade the compromises PC via security threats that exploit the vulnerability described in CVE-2012-4969. TrojanDropper:Win32/Lisfel.A contacts an external server. TrojanDropper:Win32/Lisfel.A starts a disguised Internet browser window to access the server ‘receo.konkuk.ac.kr’, most likely to divert traffic to this server.

Type: Trojans

How Can You Detect TrojanDropper:Win32/Lisfel.A?

TrojanDropper:Win32/Lisfel.A Technical Report

As new TrojanDropper:Win32/Lisfel.A details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for TrojanDropper:Win32/Lisfel.A:

The following fake error message(s) appears for TrojanDropper:Win32/Lisfel.A:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun = “Kris” = “wlupdate.exe”

TrojanDropper:Win32/Lisfel.A Removal Details

TrojanDropper:Win32/Lisfel.A has typically the following processes in memory:

• user.dll
• wlupdate.exe
• lisfl.dll

TrojanDropper:Win32/Lisfel.A creates the following files in the system:

• tmp

Important Article Disclaimer