Backdoor.Tidserv Infection.

Backdoor.Tidserv is a Trojan horse that uses an advanced rootkit to hide itself. It also displays advertisements, redirects user search results, and opens a back door on the compromised computer.

Read More

SpyEye Trojan.

SpyEye Trojan.

SpyEye is a trojan that steals sensitive information. The trojan can send the information to a remote machine. It uses techniques common for rootkits.

Read More

TSPY_ARDAMAX.HR

This is the additional infection that infects as a result of exploit HTML_SHELLCOD.SM which will be as a result of IE vulnerability. It steals information and sends it to FTP servers from where some malicious codes that run multiple routines on the infected systems. It logs keystrokes and accesses certain sites and chat logs, which further compromises a user’s privacy.

Read More

TROJ_GAMETHI.FMS

This is a Trojan Horse that will come in disguise of the users. Trojans are usually downloaded from the Internet and installed by unsuspecting users with or without their consent.Trojans typically carry payloads or other malicious actions that can range from the mildly annoying to the irreparably destructive. They may also modify system settings to automatically start. Restoring affected systems may require procedures other than scanning with an anti-virus program.

This comes in a combination of malware when there is an exploit HTML_SHELLCOD.SM. It brings 8 infections out of which Troj_GAMETHI.FMS is one of them. 


Effects:
This trojan drops copies of itself in system32 folder with a name

• fqtkz.exe

It creates the following registry keys 

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Internet Explorer\Main
  TabProcGrowth = "0"
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\URL
  SystemMgr = "Del"

Removal:

1) Disable system restore.
2) Use Process explorer tool to find the processes that are related to the Trojan.
3) If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode.
Search and delete the registry keys

• In HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
  Internet Explorer\Main
  • TabProcGrowth = "0"
• In HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
  Windows\CURRENTVERSION\URL
  • SystemMgr = "Del"
   

Delete the files that are dropped by the trojan in the system 32 folder. Uncheck Hide protected operating system files in Folders Option>View tab, and then check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result as the trojan may apply the hidden attributes to the files it dropped.

Read More

TROJ_RANSOM.QOWA

This trojan uses social engineering methods to lure users into performing certain actions that may, directly or indirectly, cause malicious routines to be performed. Specifically, it disables functionality of the compromised computer so that victims are forced to dial a premium-rate SMS number. It displays a message and prevents users accessing their desktops and applications after which users are forced to provide the required ransom by dialing the premium-rate SMS number displayed on the screen. This Trojan may be unknowingly downloaded by a user while visiting malicious websites. It modifies registry entries to enable its automatic execution at every system startup.

Read More

Win32 FlyStudio

This is a trojan that comes in as an application and will collect data and sends it to a hacker or the owner of the threat.Trojans are also called backdoors, which means the information stolen from a computer system is sent back to the intruder. The file name would be a random number and will show  up as Fly studio of Size 1.5 Mb. This is also called Trojan.Dropper that drops different malware with some payload to execute some code.

Read More