FANDOM


Katomik, also known as ATOMIC2005 or Atomik, is a trojan directly aimed at Windows users.

Payload

When run, it will copy its files into these folders.

C:\AtomicpartC.exe
Windows\K-set.bmp
C:\Atomic-x27.exe
System\mastoer32.dll

It will also create a bitmap image in the C: drive.

After being run, it'll replace the wallpaper with the @li-RNo.H.Bmp created in the C: drive. The wallpaper consists of a message to the united nations and information about the virus. Attempting to change the wallpaper will simply change it back to the bitmap file.

It'll also disable Task Manager and Regedit, stopping the virus from being killed and removed.

It will also be able to run on bootup with these registry changes.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Atomic-x27C
AtomicpartC.exe

If the trojan would be ran on Windows XP though, it fails to disable regedit and task manager, allowing you to be able to kill the process, get rid of the wallpaper, and remove the registry changes.

If the trojan can't change the wallpaper, instead, it will make an HTML file in the C: drive. The HTML is not in english, unlike the bitmap, but is instead in arabic.

Community content is available under CC-BY-SA unless otherwise noted.