Threat Search: 

ThreatExpert's Statistics for Packed.Win32.TDSS.z [Kaspersky Lab]:

Packed.Win32.TDSS.z [Kaspersky Lab] is also known as:
Threat AliasNumber of Incidents
Packed.Win32.Tdss [Ikarus]245
Trojan:Win32/Alureon.CT [Microsoft]145
Mal/TDSSPk-C [Sophos]78
Mal/Generic-A [Sophos]77
DNSChanger.t [McAfee]70
Trojan:Win32/Alureon.BK [Microsoft]67
Backdoor.Tidserv [PC Tools]65
Backdoor.Tidserv [Symantec]61
Trojan:Win32/Alureon.gen!U [Microsoft]45
Trojan Horse [Symantec]43
Win-Trojan/Xema.variant [AhnLab]40
Win-Trojan/Alureon.Gen [AhnLab]39
Mal/TDSSPack-U [Sophos]36
Mal/EncPk-KF [Sophos]28
DNSChanger.as [McAfee]24
DNSChanger.ba [McAfee]22
Mal/TDSSPack-W, Mal/TDSSPk-C [Sophos]18
Mal/TDSSPk-C, Mal/TDSSPack-W, Mal/TDSSPack-U [Sophos]18
Trojan:Win32/Alureon.DD [Microsoft]15
Trojan.Generic [PC Tools]12
Backdoor.Tidserv!gen [Symantec]11
Backdoor.Tidserv!gen2 [Symantec]11
Virus.Win32.Virut.ce [Kaspersky Lab]10
Trojan.Win32.Alureon [Ikarus]8
Win-Trojan/Alureondrv.Gen [AhnLab]7
DNSChanger!cf [McAfee]5
Packed.Win32.Krap.x [Kaspersky Lab]5
Trojan:Win32/Alureon.DB [Microsoft]5
Trojan-Downloader.Win32.Small.amcd [Kaspersky Lab]5
Win-Trojan/Tdlrootkit.75776 [AhnLab]5
DNSChanger!ck [McAfee]4
Mal/EncPk-KF, Mal/TDSSPack-P [Sophos]4
Mal/TDSSPack-U, Mal/Alureon-F [Sophos]4
Mal/TDSSPack-W [Sophos]4
Mal/TDSSPk-C, Mal/TDSSPack-W [Sophos]4
Mal/TDSSPk-C, Mal/TDSSPack-W, Mal/TDSSPack-A [Sophos]4
Mal/TDSSPk-C, Mal/TDSSPack-W, Troj/Virtum-Gen [Sophos]4
Trojan.Win32.Agent2.lbl [Kaspersky Lab]4
Trojan.Win32.Cosmu [Ikarus]4
Trojan:Win32/Meredrop [Microsoft]4
Win-Trojan/Malware.86528.H [AhnLab]4
Generic FakeAlert!ci [McAfee]3
Mal/Generic-A, Mal/TDSSPack-A [Sophos]3
Mal/TDSSPack-A [Sophos]3
Mal/TDSSPack-W, Mal/TDSSPack-U, Mal/TDSSPk-C [Sophos]3
Trojan:Win32/Alureon.CG [Microsoft]3
Backdoor.Trojan [PC Tools]2
Backdoor.Trojan [Symantec]2
DNSChanger!by [McAfee]2
DNSChanger!cg [McAfee]2
DNSChanger!dd [McAfee]2
DNSChanger.be [McAfee]2
DNSChanger.o [McAfee]2
Downloader.MisleadApp [Symantec]2
Mal/Generic-A, Troj/Virtum-Gen [Sophos]2
Mal/TDSS-F, Mal/TDSSPack-A [Sophos]2
Mal/TDSSPack-W, Mal/TDSSPack-A, Mal/TDSSPk-C [Sophos]2
Trojan:WinNT/Alureon.D [Microsoft]2
Trojan-Downloader.Win32.FraudLoad.gcl [Kaspersky Lab]2
Trojan-Spy.Win32.Zbot.z [Kaspersky Lab]2
Worm.Win32.AdwareAgent.a [Kaspersky Lab]2
Worm.Win32.AutoRun.gqx [Kaspersky Lab]2
Backdoor.Win32.Bredavi.azn [Kaspersky Lab]1
Backdoor.Win32.EggDrop.v [Ikarus]1
DNSChanger!br [McAfee]1
DNSChanger!cb [McAfee]1
DNSChanger!cy [McAfee]1
Downloader [Symantec]1
Downloader.Generic [PC Tools]1
Dropper/TDLRootkit.Gen [AhnLab]1
Exploit.Win32.WebDav.b [Kaspersky Lab]1
Exploit.Win32.WebDav.f [Kaspersky Lab]1
Exploit.Win32.WebDav.g [Kaspersky Lab]1
FakeAlert-GM [McAfee]1
Gen.Trojan [Ikarus]1
Generic BackDoor!bct [McAfee]1
Generic BackDoor!bcw [McAfee]1
Generic Downloader.x!bcj [McAfee]1
Generic Downloader.x!bgo [McAfee]1
Generic Dropper!bgl [McAfee]1
Generic FakeAlert!ck [McAfee]1
Generic FakeAlert!co [McAfee]1
Generic FakeAlert!cz [McAfee]1
Generic FakeAlert!dg [McAfee]1
Generic FakeAlert.a [McAfee]1
Generic.dx!dzw [McAfee]1
Generic.dx!etw [McAfee]1
Generic.dx!fdy [McAfee]1
Generic.dx!fgy [McAfee]1
Generic.dx!fhb [McAfee]1
Generic.dx!fsc [McAfee]1
Hacktool [Symantec]1
Hacktool.Rootkit [Symantec]1
Mal/EncPk-GU [Sophos]1
Mal/EncPk-KF, Mal/TDSSPack-U [Sophos]1
Mal/EncPk-KF, Mal/TDSSPack-U, Mal/TDSSPack-A [Sophos]1
Mal/EncPk-KF, Mal/TDSSPack-U, Mal/TDSSPack-P [Sophos]1
Mal/Generic-A, Mal/TDSSPk-C [Sophos]1
Mal/TDSSPack-J [Sophos]1
Mal/TDSSPack-Q, Mal/TDSSPack-J [Sophos]1

Packed.Win32.TDSS.z [Kaspersky Lab] has the following possible countries of origin:
OriginNumber of Incidents
Russian Federation22
China6
France3
Switzerland2
Germany1

Packed.Win32.TDSS.z [Kaspersky Lab] is known to be created as:
%AppData%\krist.exe
%Programs%\startup\kav7.0.1.325fr.exe
%Programs%\startup\ns2.exe
%System%\codec.exe
%Temp%\7zs2.tmp\keygen.exe
%Temp%\cggurl.exe
%Temp%\gasfkypahuthem.dll
%Temp%\gasfkyybxvboyr.dll
%Temp%\ixp000.tmp\codec.exe
%Temp%\suspects\gasfkymnboykjg.dll
%Temp%\tdlclk.dll
%Temp%\tdlcmd.dll
%Temp%\vhzlxxvtxlth.exe
%Temp%\vsfocebjtkoryj.dll
%UserProfile%\doulis.exe
%UserProfile%\dpthwf.exe
%UserProfile%\koocau.exe
%Windir%\temp\wpv011260179489.exe
%Windir%\temp\wpv281260179489.exe
%Windir%\temp\wpv921260179489.exe
%Windir%\temp\wpv971260179489.exe
%Windir%\wupdate.exe
Notes:
  • %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
  • %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
  • %UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.