VideoCach
Threat LevelDamageDistribution

Effects 

VideoCach carries out the following actions:

• It deceives users warning them of unexisting threats and displays a message where users are warned of the presence of malware on their systems:
  
  
• In order to remove them from the computer, users are requested to purchase a certain program.
• If the program is not purchased, from time to time it displays the following message, in order to remind them that their computer is infected:
  
  
• A red flickering triangle appears in the System Tray:
  
  
• It creates shortcuts to websites that promote rogue antivirus and antispyware programs in the Desktop.
• It has rootkit funcionalities in order to hide its files and make its detection more difficult.

Infection strategy 

VideoCach creates the following files:

• IEDRV.EXE, IEDRVCTRL.EXE, MSLOG.EXE, in the Windows directory.
• IEDRIVES.DLL and IEXPLOREE.DLL, in the Windows directory.
• MSDRV.EXE and MSLOG.EXE, in the Windows system directory.
• DRIVERPP.SYS, in the subfolder DRIVERS of the Windows system directory. This file belongs to the rootkit it uses to hide its files.

Means of transmission 

VideoCach can be installed in the affected computer without user consent, as it is automatically downloaded while accessing several adult sites or pirated software websites that use vulnerability exploits in order to affect computers.