Home Malware Programs Trojans TR/PSW.Magania.dlhj

TR/PSW.Magania.dlhj

Posted: December 23, 2010

TR/PSW.Magania.dlhj is a dangerous Trojan infection. TR/PSW.Magania.dlhj will corrupt a computer system in a variety of ways, either by a spam email messages, malicious websites or file-sharing networks. The file name of the Trojan may differ from one situation to another. If TR/PSW.Magania.dlhj is executed on the computer system, it will contact a remote server and download a list of stored passwords for online gaming websites. The Trojan infection does not steal these account details. They have more than likely been collected by other information-stealing threats. The Trojan then will use the infected computer for trying to log into these gaming websites for checking if the account is valid. It is very important that TR/PSW.Magania.dlhj is automatically detected and safely removed with a reliable spyware removal tool.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %drive%\autorun.inf
    2 %drive%\g6jk.exe
    3 %PROGRAM FILES%\Internet Explorer\IEXPLORE.EXE
    4 %SYSDIR%\arking.exe
    5 %SYSDIR%\arking0.dll
    6 %TEMPDIR%\am.exe
    7 %TEMPDIR%\am1.rar
    8 %TEMPDIR%\dsoqq.exe
    9 %TEMPDIR%\dsoqq0.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced][HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer][HKCU\Software\Microsoft\Windows\CurrentVersion\Run][HKLM\SOFTWARE\Classes\CLSID\MADOWN][HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HKEY..\..\..\..{RegistryKeys}"CheckedValue"=dword:0x00000000"Hidden"=dword:0x00000002"King_ar"="%SYSDIR%\arking.exe""NoDriveTypeAutoRun"=dword:0x00000091"ShowSuperHidden"=dword:0x00000000"dso32"="%TEMPDIR%\dsoqq.exe""urlinfo"="dfxsri.i"Folder\Hidden\SHOWALL]
Loading...