Home Malware Programs Trojans Infostealer.Nasdosto

Infostealer.Nasdosto

Posted: January 23, 2013

Threat Metric

Ranking: 3,707
Threat Level: 9/10
Infected PCs: 38,136
First Seen: January 23, 2013
Last Seen: March 8, 2025
OS(es) Affected: Windows

Infostealer.Nasdosto is a Trojan that steals information from the attacked computer system. Once executed, Infostealer.Nasdosto creates the files on the affected machine. Infostealer.Nasdosto creates the registry entries so that it can run automatically every time a PC user starts Windows. Infostealer.Nasdosto records keystrokes on the targeted PC. Infostealer.Nasdosto sends the gathered information to one of the remote locations.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\ns2dos File name: %System%\ns2dos
Group: Malware file
%System%\ns2dos.exe File name: %System%\ns2dos.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\ns6dos File name: %System%\ns6dos
Group: Malware file
%System%\ns6dos.exe File name: %System%\ns6dos.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\ns7dos File name: %System%\ns7dos
Group: Malware file
%System%\ns7dos.exe File name: %System%\ns7dos.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\nsdos2 File name: %System%\nsdos2
Group: Malware file
%System%\nsdos2.exe File name: %System%\nsdos2.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"nsdos-debugg" = "[HEXADECIMAL CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"msdos-debug2" = "[HEXADECIMAL CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"msdos-debug" = "[HEXADECIMAL CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\[RANDOM CLSID]\"StubPath" = "[HEXADECIMAL CHARACTERS]"
Loading...