Home Malware Programs Trojans Trojan.Win32.Midgare.hhn

Trojan.Win32.Midgare.hhn

Posted: March 2, 2011

Trojan.Win32.Midgare.hhn is a Trojan that attacks Windows systems and uses rootkit-based tricks to remain hidden from the user. Trojans closely linked to Trojan.Win32.Midgare.hhn have been noted to download malicious programs, alter browser settings and generally destroy computer security. There are few easy to see cues of this Trojan's hostile behavior, and you may not know you need to delete Trojan.Win32.Midgare.hhn until it's already harmed your machine.

An Elderly Threat is Still a Threat

Variations of Trojan.Win32.Midgare.hhn have been seen as long ago as 2008, making this Trojan quite old in Internet years. However, Trojan.Win32.Midgare.hhn's ability to spread through deceptive means keeps Trojan.Win32.Midgare.hhn a threat on the radar of anyone concerned with computer security. Trojan.Win32.Midgare.hhn has been confirmed to be able to infect Windows 7, Windows 2000 and most versions of Windows between those two.

Attacks by Trojan.Win32.Midgare.hhn are sophisticated and range from medium-level to high-level threats to your computer's security and overall integrity, as seen below:

  • The Trojan.Win32.Midgare.hhn Trojan will use registry changes to allow Trojan.Win32.Midgare.hhn to run passively when Windows starts without requiring manual execution or any other obvious triggers.
  • Trojan.Win32.Midgare.hhn and other Trojans can download and install programs without the user being cognizant of the activity. This lets Trojan.Win32.Midgare.hhn create other widely varied problems for the host system and may be used to ease remote attacks by anonymous criminals.
  • Trojan.Win32.Midgare.hhn registers .dll files which complicate the process of deleting Trojan.Win32.Midgare.hhn and generally assists malicious activities.
  • The most invasive danger of Trojan.Win32.Midgare.hhn is its ability to corrupt other processes in memory through rootkit tactics. This lets Trojan.Win32.Midgare.hhn run with less chance of being seen, and also makes Trojan.Win32.Midgare.hhn exceptionally difficult to remove.
  • There have been cases of Trojan.Win32.Midgare.hhn-related infections abusing proxy servers. This is done to hijack web browser applications so that malicious websites garner the user's attention by force. Hijacking behavior also typically blocks out security websites and other safe and necessary online sources for computer safety tools.
Cutting Trojan.Win32.Midgare.hhn Infections Down to Size

Given the fact that Trojans like Trojan.Win32.Midgare.hhn will infect computers secretively, keeping your security software running while online is an excellent way to defend your system. Trojan.Win32.Midgare.hhn may also be identified in scans through the aliases of Troj/Bifrose-VZ and BKDR_AHZE.A.

If you find yourself dealing with other malware, commence a full system scan immediately – Trojan.Win32.Midgare.hhn or a related Trojan may be accountable for the presence of these more visible threats. Watch for unusual pop-ups or desktop alert messages, embedded links, strange browser behavior and the presence of unfamiliar processes or files. All these can be signs of malware downloaded by this Trojan, but even with no overt signs, you'll want to delete Trojan.Win32.Midgare.hhn without any hesitation or delay.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %appdata%\microsoft\internet explorer\quick launch\Trojan..Win32.Midgare.hhn.lnk
    2 %commonprograms%\Trojan..Win32.Midgare.hhn\about.lnk
    3 %commonprograms%\Trojan..Win32.Midgare.hhn\activate.lnk
    4 %commonprograms%\Trojan..Win32.Midgare.hhn\buy.lnk
    5 %commonprograms%\Trojan..Win32.Midgare.hhn\scan.lnk
    6 %commonprograms%\Trojan..Win32.Midgare.hhn\settings.lnk
    7 %commonprograms%\Trojan..Win32.Midgare.hhn\Trojan..Win32.Midgare.hhn support.lnk
    8 %commonprograms%\Trojan..Win32.Midgare.hhn\Trojan..Win32.Midgare.hhn.lnk
    9 %commonprograms%\Trojan..Win32.Midgare.hhn\update.lnk
    10 %desktop%\Trojan..Win32.Midgare.hhn support.lnk
    11 %desktop%\Trojan..Win32.Midgare.hhn.lnk
    12 %programfiles\Trojan..Win32.Midgare.hhn\about.ico
    13 %programfiles\Trojan..Win32.Midgare.hhn\activate.ico
    14 %programfiles\Trojan..Win32.Midgare.hhn\buy.ico
    15 %programfiles\Trojan..Win32.Midgare.hhn\def.db
    16 %programfiles\Trojan..Win32.Midgare.hhn\defcnt.exe
    17 %programfiles\Trojan..Win32.Midgare.hhn\defext.dll
    18 %programfiles\Trojan..Win32.Midgare.hhn\defhook.dll
    19 %programfiles\Trojan..Win32.Midgare.hhn\help.ico
    20 %programfiles\Trojan..Win32.Midgare.hhn\scan.ico
    21 %programfiles\Trojan..Win32.Midgare.hhn\settings.ico
    22 %programfiles\Trojan..Win32.Midgare.hhn\splash.mp3
    23 %programfiles\Trojan..Win32.Midgare.hhn\uninstall.exe
    24 %programfiles\Trojan..Win32.Midgare.hhn\update.ico
    25 %programfiles\Trojan..Win32.Midgare.hhn\virus.mp3

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Trojan.Win32.Midgare.hhnhkcu\Software\Microsoft\Windows\CurrentVersion\Run "Trojan..Win32.Midgare.hh"hklm\SOFTWARE\Trojan..Win32.Midgare.hhnHKEY..\..\..\..{RegistryKeys}hkcr\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Trojan..Win32.Midgare.hhn
Loading...