Home Malware Programs Trojans TrojanDownloader:Win32/Spycos.R

TrojanDownloader:Win32/Spycos.R

Posted: October 17, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 66
First Seen: October 17, 2012
OS(es) Affected: Windows

TrojanDownloader:Win32/Spycos.R is Trojan that downloads and executes other PC threats from a remote server. TrojanDownloader:Win32/Spycos.R also terminates security processes and services, and steals information about the affected computer. Once installed, TrojanDownloader:Win32/Spycos.R makes system changes by adding potentially malicious files. TrojanDownloader:Win32/Spycos.R blocks AVG and Avast security programs from normal working by terminating processes and services of anti-virus software if they exist on the computer. TrojanDownloader:Win32/Spycos.R copies itself as a CPL file to the Temporary Files folder with a random 12-digit file name. TrojanDownloader:Win32/Spycos.R creates the certain registry entry so that the file runs automatically every time you start Windows. TrojanDownloader:Win32/Spycos.R disables Least User Access (LUA) and eliminates Browser Helper Objects (BHO) that refer to security toolbars for AVG if it finds them on the PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%\FXSAPIDebuglog.DLL File name: %Temp%\FXSAPIDebuglog.DLL
File type: Dynamic link library
Mime Type: unknown/DLL
Group: Malware file
%Temp%\_thundbs2.db File name: %Temp%\_thundbs2.db
Mime Type: unknown/db
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}HKEY_LOCAL_MACHINE\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}HKEY_LOCAL_MACHINE\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = "<14 RANDOM NUMBERS>" = "%Temp%\"
Loading...