Home Malware Programs Trojans Infostealer.Proxydown

Infostealer.Proxydown

Posted: December 28, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 2
First Seen: December 28, 2012
OS(es) Affected: Windows

Infostealer.Proxydown is a Trojan that steals computer data and information form Internet Explorer and may download malicious files on to the infected computer system. Once executed, Infostealer.Proxydown creates potentially malicious files. Infostealer.Proxydown creates a registry entry so that it can run automatically whenever you start Windows. Infostealer.Proxydown modifies the registry entry to change Internet Explorer settings. Infostealer.Proxydown checks the proxy configuration information on the victimized PC. Infostealer.Proxydown connects google.com to create an Internet connection. Infostealer.Proxydown transfers all of the stolen information to certain remote locations.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



wmshlp.dll File name: wmshlp.dll
Size: 106.49 KB (106496 bytes)
MD5: 3ac94e32920b27b16fbcf8dc027cf054
Detection count: 33
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: January 7, 2013
21ac774a6717ec3e70de1e91324ffcc8 File name: 21ac774a6717ec3e70de1e91324ffcc8
Size: 112.12 KB (112128 bytes)
MD5: 21ac774a6717ec3e70de1e91324ffcc8
Detection count: 32
Group: Malware file
Last Updated: January 7, 2013
7d95302e81c5a69fe18920f9d57c5644 File name: 7d95302e81c5a69fe18920f9d57c5644
Size: 105.98 KB (105984 bytes)
MD5: 7d95302e81c5a69fe18920f9d57c5644
Detection count: 29
Group: Malware file
Last Updated: January 7, 2013
%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll144031u23.tmp File name: %UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll144031u23.tmp
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file
%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll File name: %UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\[RANDOM CHARACTERS FILE NAME].tmp File name: %Temp%\[RANDOM CHARACTERS FILE NAME].tmp
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file
%Temp%\[RANDOM CHARACTERS FILE NAME].datce File name: %Temp%\[RANDOM CHARACTERS FILE NAME].datce
Mime Type: unknown/datce
Group: Malware file
%Temp%\[RANDOM CHARACTERS]wg[RANDOM DIGIT].dat File name: %Temp%\[RANDOM CHARACTERS]wg[RANDOM DIGIT].dat
File type: Data file
Mime Type: unknown/dat
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"TactXCI" = "rundll32.exe \"%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll\" TactXCIHlp 137"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"DefaultConnectionSettings" = "[BINARY DATA]"
Loading...