Home Malware Programs Trojans Trojan.Win32.Sasfis.uak

Trojan.Win32.Sasfis.uak

Posted: November 10, 2009

Trojan.Win32.Sasfis.uak is another Trojan that produces outbound traffic and requests other files from Internet once it gains entry to the compromised system. Trojan.Win32.Sasfis.uak will most likely create a startup registry entry and may modify some system executable files with a PE-file infector. Trojan.Win32.Sasfis.uak can also create a toolbar installed on your Internet Explorer that sends information to MSN and Alexa if used. Trojan.Win32.Sasfis.uak will in memory after executed, infecting more files on every drive and network share. Trojan.Win32.Sasfis.uak poses a huge threat to the safety of any computer or network and it is recommended that it be removed once detected.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
    2 %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
    3 %ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
    4 %ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
    5 %ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
    6 %ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
    7 %ProgramFiles%\Internet Explorer\iedw.exe
    8 [pathname with a string SHARE]\DW20.EXE
    9 [pathname with a string SHARE]\DWTRIG20.EXE
    10 [pathname with a string SHARE]\msinfo32.exe
    11 [pathname with a string SHARE]\sapisvr.exe
Loading...