Home Malware Programs Trojans Trojan.Win32.Patched.ka

Trojan.Win32.Patched.ka

Posted: March 4, 2011

Trojan.Win32.Patched.ka is a Trojan that downloads and installs malware while disabling security settings and applications. This Trojan is reported to focus on stealing passwords and other private information by dropping spyware programs, causing Trojan.Win32.Patched.ka to be a prime culprit for potential keylogging. The Patched.ka Trojan may be difficult to detect due to compression methods and can attack most versions of Windows, so don't judge the book by its cover or assume you're safe just because you're using a new version of an OS.

How Trojan.Win32.Patched.ka Exploits Cracks in Your Security

Since Trojan.Win32.Patched.ka is both a Trojan and a probable spyware-enabler Trojan.Win32.Patched.ka has serious incentive to stay hidden when infecting a computer. Some sources indicate that certain versions of Trojan.Win32.Patched.ka can spread through networks; this can be prevented by scanning network-shared files before using them on any individual networked machine. Trojan.Win32.Patched.ka may be compressed or packed by an external program; this reduces Trojan.Win32.Patched.ka's size and makes Trojan.Win32.Patched.ka hard for anti-malware programs to detect during installation.

Trojans like Trojan.Win32.Patched.ka can be downloaded onto your computer directly by a hostile website if your security settings are poor enough. However, they're usually acquired through intentional downloads of infected or mislabeled files instead, which can be uploaded to free application warehouse sites or to peer-to-peer file-sharing networks.

Trojan.Win32.Patched.ka is a Trojan with an Eye on Your Login Info

Trojan.Win32.Patched.ka is a threat to Windows 7 users as well as to users of earlier versions of the OS. By using corrupted registry functions, Trojan.Win32.Patched.ka can perform attacks like these without letting you know anything is wrong:

  • Malware downloads. Trojan.Win32.Patched.ka is especially noted for downloading spyware such as keyboard-recording keyloggers and other dangerous programs that concentrate on stealing passwords and similar information. They may grab input from your peripheral devices or scan over content saved in files; advanced spyware can even take screenshots!
  • Attacks by remotely-located criminals. Along with dropping spyware, Trojan.Win32.Patched.ka may also drop software that lets a remote attacker control or damage your computer. This is a source of high-profile crimes like DDoS attacks.
  • Altered system settings and blocked security functions. Trojan.Win32.Patched.ka is reported to attack certain Security Center functions directly such as notifications for updates and virus alerts.

Removing Trojan.Win32.Patched.ka may be done either manually by an expert or automatically by good anti-malware programs. Either way, though, you should stop all malware from running before you try to delete Trojan.Win32.Patched.ka, and check your registry as well as actual files.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\data.dat,%AppData%\SEXY.exe
    2 %PROGRAM_FILES%\Trojan.Win32.Patched.ka
    3 %Temp%\IXP000.TMP\SEXY.exe,%Temp%\1.tmp
    4 c:\Documents and Settings\All Users\Start Menu\Trojan.Win32.Patched.ka \
    5 c:\Documents and Settings\All Users\Trojan.Win32.Patched.ka \

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{C7BAADA4-DC89-B5DA-ABC2-C9BAD66F8AAF}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C7BAADA4-DC89-B5DA-ABC2-C9BAD66F8AAF}HKEY_LOCAL_MACHINE\Software\Trojan.Win32.Patched.kaHKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideoHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ExplorerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
Loading...