Home Malware Programs Trojans Trojan.Nedsym

Trojan.Nedsym

Posted: January 26, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 6,460
First Seen: January 26, 2012
Last Seen: August 9, 2020
OS(es) Affected: Windows

Trojan.Nedsym is a malicious Trojan that spreads via spam emails. Trojan.Nedsym is a serious risk to your computer system and personal security. Trojan.Nedsym can also gather information about your PC system and transmit it to a remote server that is responsible for configuring Trojan.Nedsym. Trojan.Nedsym modifies the registry during the installation so that it could run automatically every time you start your Windows. Then Trojan.Nedsym checks whether there's another version of a Trojan installed in the computer, and if not, it starts executing its malicious actions. At first, Trojan.Nedsym gets into the registry key that belongs to Internet Explorer and gathers all the user names and passwords saved in there. Thus, Trojan.Nedsym can gain an access to the frequently visited websites. Trojan.Nedsym also affects other web browser including Mozilla Firefox. Trojan.Nedsym connects to a remote server without your permission and receives configuration data about what type of spam messages it has to send. Trojan.Nedsym can create a random domain name, and then it might use one of several names to transmit and access information from its remote server. Use a reputable anti-malware tool to completely uninstall Trojan.Nedsym.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\WMPRWISE.EXE File name: WMPRWISE.EXE
Size: 181.24 KB (181248 bytes)
MD5: d2505f3201ae659d9626c3060a443d66
Detection count: 171
File type: Executable File
Mime Type: unknown/EXE
Path: %APPDATA%
Group: Malware file
Last Updated: April 30, 2016
atl(4)32.dll File name: atl(4)32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
svcnost.exe File name: svcnost.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
cf.dll File name: cf.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
GoogleDownload.exe File name: GoogleDownload.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
kbdcr32.dll File name: kbdcr32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
jan.dll File name: jan.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
api-ms-win-core-memory-l1-1-032.dll File name: api-ms-win-core-memory-l1-1-032.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
svcserv.exe File name: svcserv.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
RegalRO.exe File name: RegalRO.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
svchost.exe File name: svchost.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
AdobeUpdate.exe File name: AdobeUpdate.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
upd_debug.exe File name: upd_debug.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
qtplugin.exe File name: qtplugin.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
3x2ua64.com File name: 3x2ua64.com
File type: Command, executable file
Mime Type: unknown/com
Group: Malware file
windows update.exe File name: windows update.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
pf10373.dll File name: pf10373.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
itlnfw32.dll File name: itlnfw32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
credman.dll File name: credman.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
ucrtupd.exe File name: ucrtupd.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
FW-267279124.exe File name: FW-267279124.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%APPDATA%\WMPRWISE.EXE

Related Posts

Loading...