30

Oct

Trojan-Proxy.Win32.Small.fk

Posted by admin  Published in Virus

Play online games at GameDuell.
New Training Titles for Audio Software, Hardware & Technical Skills.
Shockwave has the game Risk! Buy it now!
Join LinkShare Today!
SYNC Outlook and Files on all your Computers

Trojan-Proxy.Win32.Small.fk
This Trojan program makes it possible for a remote malicious user to use the victim machine as a proxy server. It is a Windows PE EXE file. It is 8,682 bytes in size. It is packed using FSG. The unpacked file is approximately 49KB in size. It is written in Visual C++.

Installation

When launched, the Trojan drops a .dll file will a random name to the Windows system directory:

%System%\<random collection of symbols> – 7,168 bytes in size. This file will be detected by Kaspersky Anti-Virus as Trojan.Win32.Obfuscated.fw

The Trojan then creates the following registry key:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fade]
"DllName" = "<random collection of symbols>.dll"
"MaxWait" = " dword: 0x00000001"
"Logon" = "Event"
"Asynchronous" = "dword: 0x00000001"
"Impersonate" = "dword: 0x00000001"

(Captured from pcsecurityshield.com)

Related Articles

No user responded in this post

Subscribe to this post comment rss or trackback url
Leave A Reply

 Username (Required)

 Email Address (Remains Private)

 Website (Optional)