Home Malware Programs Trojans Trojan.Smowbot

Trojan.Smowbot

Posted: October 22, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 13
First Seen: October 22, 2012
OS(es) Affected: Windows

Trojan.Smowbot is a Trojan that opens a back door and drops more PC threats onto the affected computer. Once executed, Trojan.Smowbot copies itself by adding the potentially malicious files. Trojan.Smowbot then creates the certain registry entry so that it can run automatically every time you start Windows. Trojan.Smowbot creates the certain registry entries to bypass the Windows firewall. Trojan.Smowbot also modifies numerous registry entries. Trojan.Smowbot attempts to contact a command-and-control server in order to receive commands that enable remote attackers to perform malicious actions, such as download and execute additional files, update itself and send spam emails in order to distribute itself to other computers.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\admparse.exe File name: %System%\admparse.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\actxprxy.exe File name: %System%\actxprxy.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"smwcore" = "%System%\admparse.exe"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\admparse.exe" = "%System%\admparse.exe:*:Enabled:enable" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\actxprxy.exe" = "%System%\actxprxy.exe:*:Enabled:enable"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"FileTracingMask" = "4294901760"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"MaxFileSize" = "1048576"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"EnableFileTracing" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"FileDirectory" = "%Windir%\tracing"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"ConsoleTracingMask" = "4294901760"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\FWCFG\"EnableConsoleTracing" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\"LogSessionName" = "stdout"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr\"BitNames" = "NAP_TRACE_BASE NAP_TRACE_NETSH"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr\"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier\"BitNames" = "Error Unusual Info Debug"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier\"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\"Active" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\"ControlFlags" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\"Active" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\"ControlFlags" = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\"LogSessionName" = "stdout"
Loading...