Home Malware Programs Trojans Trojan-Dropper.Win32.Dapato.aby

Trojan-Dropper.Win32.Dapato.aby

Posted: August 4, 2011

Trojan-Dropper.Win32.Dapato.aby is a seditious Trojan infection that pretends to be a legitimate program so that it can't be detected by an anti-virus program. Trojan-Dropper.Win32.Dapato.aby can proliferate via the network if the malicious drive is shared on the network. Trojan-Dropper.Win32.Dapato.aby often invades the compromised PC in the background without your consent. When on a targeted machine, Trojan Dropper.Win32.Dapato.aby can download other malware components to the affected PC system and can steal the user's personal information. Trojan-Dropper.Win32.Dapato.aby is able to remotely access the corrupted computer system. Once connected with the remote server, Trojan-Dropper.Win32.Dapato.aby requests files from it and slows down the infected computer. Remove Trojan-Dropper.Win32.Dapato.aby from your computer system immediately.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AppData%\System.log File name: %AppData%\System.log
Size: 100B (100 bytes)
MD5: 0xB278C253B9159E091C5A92756D8ED0
Mime Type: unknown/log
%AppData%\netprotocol.exe File name: %AppData%\netprotocol.exe
Size: 47B (47 bytes)
MD5: 0xF003C626CEE76874CDB3EC5DA71D4C
File type: Executable File
Mime Type: unknown/exe
%AppData%\netprotdrvss.exe File name: %AppData%\netprotdrvss.exe
Size: 80B (80 bytes)
MD5: 0xB8D941AB280E932A755EE3F0F19C10
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/javascript CLSID = "{25336920-03F9-11cf-8FD0-00AA00686F13}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-javascript CLSID = "{25336920-03F9-11cf-8FD0-00AA00686F13}"HKEY..\..\{Value}[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current] (Default) =HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-javascriptHKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/javascriptHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Netprotocol = "%AppData%\netprotocol.exe"

Additional Information

The following URL's were detected:
http://fruitch.com/nconfirm.php?rev=348&code=3&param=0&num=13483582753792http://fruitch.com/nconfirm.php?rev=348&code=7&param=0&num=13483582753792http://fruitch.com/nconfirm.php?rev=348&code=8&param=0&num=13483582753792http://fruitch.com/njob.php?num=15053295238068636672&rev=348http://onslali.in/test/netprotocol.exe
Loading...