Trojan.Oficla.26
(Gen:Trojan.Heur.bmW@r1fi4Jlaf, Trojan.MTA.whmg, TR/Agent.W.4067, TR/FraudP.anmu.2992, TrojanDropper:Win32/Oficla.G, Generic Dropper!dgg, TR/Crypt.XPACK.Gen, Parser error, TROJ_DLOADR.SMVE, Generic.dx!oto, LooksLike.Win32.Malware!B (v), Trojan.Win32.Fregee.bk, TR/Fregee.BK.1, BKDR_QAKBOT.SMB, Gen:Heur.Krypt.28, Trojan:Win32/Oficla.M, Generic.dx!ouc, Trojan.Generic.3153952, Trojan.Win32.Fregee.as, Gen:Trojan.Heur.bmW@rbhUipfaf, Packed.Win32.Krap.gx, Trojan.Generic.3204892, Trojan.Win32.Sasfis.ahjp)
Added to the Dr.Web virus database:
2010-02-26
Virus description added:
2010-03-14
This is a trojan downloader. Feature of this trojan is that if your computer has Microsoft Word, it downloads malicious files through it:
- Drops dll (which is detected as Trojan.Oficla.26) in a temporary folder;
- Uses macros in Word. Implements:
Declare Function bafuvl Lib "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5.tmp"(ByVal s AS String) As Long
If there is no Microsoft Word on computer, it runs in the process svchost.exe using the same storage dll.
The name is taken from antivirus Microsoft probably named because of the Office.
