Home Malware Programs Trojans Trojan.Nawpers

Trojan.Nawpers

Posted: March 6, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 16
First Seen: March 6, 2013
OS(es) Affected: Windows

Trojan.Nawpers is a Trojan horse that could be used by hackers to modify the MBR (master boot record) of a system. When Trojan.Nawpers modifies the MBR, it could then be used to steal personal data stored on the infected system where a remote hacker could obtain this information and use it against the computer user. Being that Trojan.Nawpers is a serious threat to information on a system, it is highly advisable that action be taken without delay to remove Trojan.Nawpers.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 227.84 KB (227840 bytes)
MD5: 40d1297c7497be8941d9e50c80952143
Detection count: 76
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 13, 2013

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"ClassGUID" = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"Service" = "DrvInstallDemo"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"DeviceDesc" = "DrvInstallDemo"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVINSTALLDEMO\"NextInstance" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet_SpacE_Settings\Connections\"DefaultConnectionSettings" = "3c,00,00,00,11,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,1c,00,00,00,68,74,74,70,3a,2f,2f,31,37,32,2eHKEY_CURRENT_USER\Software\Microsoft\"systemkey" = "[PATH TO TROJAN]"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
Loading...