Encyclopedia entry
Updated:
May 23, 2012
| Published:
May 18, 2012
Aliases
Not available
Alert Level
(?)
Severe
Antimalware protection details
Microsoft recommends that you download the
latest definitions
to get protected.
Summary
Virus:Win32/Quervar.A is a virus that infects specific Microsoft Office document files and executable files.
Symptoms
System changes
The following system changes may indicate the presence of this malware:
- Some of your document files may be missing
- The presence of the following file:
%windir%\xpsp2res.dll
Technical Information (Analysis)
Virus:Win32/Quervar.A is a virus that infects specific Microsoft Office document files and executable files.
Installation
When an infected file is run, it drops and runs the original host file in the current folder as a hidden file with a randomly generated name to make it appear as if it is not infected.
Virus:Win32/Quervar.A then drops copies of itself as the following:
-
%AppData%\Microsoft\<random characters>.exe
-
%windir%\xpsp2res.dll
Spreads via...
File infection
Virus:Win32/Quervar.A infects the following file types:
It searches for files to infect in all logical drives except those labeled as:
-
CDROM drives
- Unknown drives
Virus:Win32/Quervar.A infects files by creating copies of itself with the original host file encrypted at the end. If the host file is a .doc or .docx file, the infected file is named using the following format:
<original host file name>xcod.scr
If the host file is an .exe file, the infected file name is the same as the host file.
The host files are then deleted, so only the infected files remain.
Payload
Connects to certain servers
Virus:Win32/Quervar.A connects to any of the following servers:
-
avtoclub.eu
-
vnk.sk
-
1nlreality.sk
-
forum.perfect-privacy.com
Terminates system processes
Virus:Win32/Quervar.A may prevent Task Manager from running.
Analysis by Francis Allan Tan Seng
Prevention
Recovery
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:
For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.
