Home Malware Programs Trojans Trojan.Parpwuts.B

Trojan.Parpwuts.B

Posted: December 5, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 14
First Seen: December 5, 2012
Last Seen: April 8, 2020
OS(es) Affected: Windows

Trojan.Parpwuts.B (Trojan:MSIL/Parpwuts.B) is a Trojan that displays advertising or pornographic websites on the compromised PC. Trojan:MSIL/Parpwuts.B may pretend to be a legal driver or update for a keyboard. Once installed on the infected computer system, makes system changes by dropping potentially malicious files and making registry modifications. Trojan.Parpwuts.B modifies the registry entry to assure that its copy loads every time you start Windows.

Aliases

Trj/CI.A [Panda]Dropper.Agent.AZOG [AVG]W32/Dorifel.WQP!tr [Fortinet]Win32.SuspectCrc [Ikarus]Trojan/Win32.Windef [AhnLab-V3]Trojan:MSIL/Parpwuts.B [Microsoft]Artemis!3E190C6F31C3 [McAfee-GW-Edition]TR/Zusy.27426.4 [AntiVir]Trojan.DownLoader7.8295 [DrWeb]UnclassifiedMalware [Comodo]Mal/Generic-L [Sophos]Trojan-Dropper.Win32.Dorifel.wqp [Kaspersky]Win32.Trojan [eSafe]MSIL:Agent-ZT [Trj] [Avast]Trojan.Gen [Symantec]
More aliases (29)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%USERPROFILE%\NlsDareg.exe File name: NlsDareg.exe
Size: 183.29 KB (183296 bytes)
MD5: 3e190c6f31c37910430885908b09b289
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%
Group: Malware file
Last Updated: April 8, 2020

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows\CurrentVersion\Run "Windows Explorer" = "%HOMEPATH%\Administrator\drivers\[malware file]"HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows\CurrentVersion\Run "Windows Explorer" = "%HOMEPATH%\Administrator\drivers\[malware file]", for example "explorer.exe"HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM VALUE]", for example "M0UxOTBDNkYQwErTaSdFg" = "%HOMEPATH%\Administrator\[malware file]"
Loading...