Home Malware Programs Trojans Trojan.Namsala

Trojan.Namsala

Posted: March 7, 2011

Trojan.Namsala disables various applications on your computer and is likely to target security-based programs and settings. As a Trojan, Trojan.Namsala can install other types of malware on your system that can be used to steal information, enable access by remote hackers or cause other forms of damage. Trojan.Namsala is a very new threat and can attack most Windows systems, so users should take precautions like keeping their anti-malware security fully updated in terms of malware definition databases.

Letting Your PC's Security Programs Tend to Themselves

The Trojan.Namsala will usually infect a computer after a browser is directed to a dangerous website or when the user downloads an infected .exe file. If your anti-malware programs are active and updated, they should be able to stop Trojan.Namsala before it digs its way in too deeply. Be especially alert if your security applications have less recent threat definitions than March of 2011, since that's when Trojan.Namsala had its identity confirmed.

So far, Trojan.Namsala has been verified to be able to attack recent OSes like Windows Vista, as well as older ones (for example, Windows 98). Windows 7 hasn't been confirmed to be vulnerable to infection, but you shouldn't let that serve as your only protection - many Trojans are frequently updated to keep pace with OS releases.

The predominant confirmed symptom of Trojan.Namsala infection is blocked applications, with a particular likelihood of losing access to your security and Windows diagnostics programs like Task Manager. This may or may not correspond with error messages used to mislead you into thinking that your application is infected or corrupted in some manner; be wary of strange error messages related to nonfunctional anti-malware programs if you suspect a Trojan.Namsala infection!

Trojan.Namsala's Arsenal of Secondary Attacks

Although disabled security programs are the primary trait of possible Trojan.Namsala infection, other attacks can also occur, such as:

  • The presence of malware and strange files or memory processes on your system. Trojans download and install these without permission from the user, primarily for the purpose of extracting money through rogue security application fraud or account login-stealing spyware.
  • Hanged security or browser settings, such as enabled proxy server use or a lowered firewall. Most Trojans like Trojan.Namsala will disable or hamper firewalls to allow their malicious downloadvertisement.
  • Access by remote attackers. In obvious cases, this can be seen as mysterious system input such as a printer activated without your permission or strange cursor movement. Most forms of remote attacks will be subtle, however, and you will primarily only see them by observing the corresponding poor security settings.

Allowing your computer to remain vulnerable to this Trojan's attacks will result in all information being at risk and can even cause permanent system damage. Delete Trojan.Namsala from your PC by first disabling Trojan.Namsala to allow the use of security applications, and then scanning your computer for all possible infection-related components.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %DriveLetter%\AV[RANDOM CHARACTER]SEQ01.DAT.exe
    2 %SystemDrive%\AV[RANDOM CHARACTER]SEQ01.DAT.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Photo" = "%SystemDrive%\AV[RANDOM CHARACTER]SEQ01.DAT.exe"
Loading...