Trojan:BAT/Ski.A

Trojan:BAT/Ski.A is a batch file, which may arrive in the computer as a self-extracting RAR. It attempts to delete files, change the label of drive E:, and reassociate executable file extensions.

Installation

Upon extraction, it copies itself as the hidden file "C:\ski.bat".

If the file "autoexec.bat" exists in the computer, Trojan:BAT/Ski.A adds the line "ski.bat" to it so that it automatically runs when the computer starts. If this file does not exist, Trojan:BAT/Ski.A creates it.

Payload

Modifies drive labels
Trojan:BAT/Ski.A sets the label of drive E: to "PRIDUROK".

Modifies file associations
Trojan:BAT/Ski.A changes file associations so that all files with the .EXE extension are treated as .MP3 files.

Attempts to delete files and folders
Trojan:BAT/Ski.A attempts to delete the folder "C:Program Files", including all files in it. However, since the parameter is not in quotations, as a result, the system attempts to delete a file called "C:Program" and another called "files".

Additional information

Trojan:BAT/Ski.A displays "Virus Loading" and "VIRUS LOAD" in an "echo" command.

Analysis by Chris Stubbs