PcClient.VK, a variant of PcClient, is a Trojan. PcClient.VK attempts to hide processes, files, registry data and network connections and allows the attacker to perform arbitrary actions on the infected machine. PcClient.VK has a rootkit functionality and steals sensitive information from an infected computer.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
PcClient.VK is seen in the wild as the payload file installed on a host machine by a specially crafted Microsoft PowerPoint file that contains exploit code.
Once execution of PcClient.VK been initiated, its executable component will drop the following hard-coded files in the Windows System directory:
Note: the file size of Ybrcuugm.d1l might vary due to garbage code appended at the end of the file.
It will also drop the following driver that will communicate with the dll files in order to hide the malware's processes, registry entries and files:
Moreover it also hides some network traffic that the PcClient.VK uses.
It modifies the following known registry entry as its autostart technique:
Data before:
Data after:
In order for the system to work normally, Ybrcuugm.dll will execute its malicious routine and then pass the correct parameter to the original dmserver.dll.
It also adds the following autostart registry entry for the driver:
Part of its payload is that is logs all the keystrokes made by the user and saves it to the following file:
It then sends this file to a remote hacker.
Another part of the payload is that it has a backdoor component. The backdoor routine is injected into svchost.exe, which is capable doing the following:
This malware connects to the following site: