Trojan-Dropper.Win32.Agent.sd

Technical Details

This Trojan program masks its presence in the system from users and from other programs. It is a Windows PE SYS file. It is 4384 bytes in size. It is not packed in any way. It is written in C.

Installation

This malicious program will be installed to the victim machine together with other malicious programs. It is used to hide the activity of other malicious programs in the system.

When launched, the program copies itself to the Windows system directory:

It adds the following key to the system registry:

[HKLM\System\CurrentControlSet\Services\Driver]
"ImagePath" = "%System%\nso12k.sys"

Payload

This malicious program functions as an IP Filter Driver and filters the user’s Internet traffic. It uses object functionality in ntoskrnl.exe and ndis.sys in order to do this.

The program also makes the activity of other malicious programs in the system, making it possible for such programs to gain unhindered access to the Internet.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the following system registry key value:

   [HKLM\System\CurrentControlSet\Services\Driver]
   "ImagePath" = "%System%\nso12k.sys"

2. Reboot the computer.
3. Delete the following file:
   %System%\nso12k.sys
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Summary

• Performs potentially dangerous activity

Technical details

File size of 51243 bytes.

Installation

Makes copies of itself with the following names once launched:

• Windows directory (usually, C:\Windows)%Windir%\winmng.exe

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of the following installed files:

using system services:

Service name:	WINSERVICEMNG
Displayed service name:	WINSERVICEMNG
Startup parameters	Windows directory (usually, C:\Windows)%Windir%\winmng.exe
Startup type:	­automatic­

Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions ] "d" = "<­path to source program­><­file of source program ­>"