Home Malware Programs Trojans W32/Trojan2.NOXC

W32/Trojan2.NOXC

Posted: October 25, 2011

Threat Metric

Threat Level: 8/10
Infected PCs: 67
First Seen: October 25, 2011
OS(es) Affected: Windows

W32/Trojan2.NOXC is a malicious Trojan that is used by hackers in DLL hijacking techniques. W32/Trojan2.NOXC loads a malicious DLL called "deskpan.dll" that corrupts numerous applications. W32/Trojan2.NOXC drops legitimate files together with its malicious DLL from within a directory. W32/Trojan2.NOXC exploits a Windows bug, which enables components to install outside libraries using one specific style. Essentially, DLL files immediately occur as DLL compromising elements, within a directory, and if these files are viewed, malicious DLL files get installed as well. W32/Trojan2.NOXC also uses legitimate files such as .rtf and .txt to corrupt targeted PCs. To execute the malicious file "deskpan.dll", it needs to be located in the folder named "[any characters]. {42071714-76D4-11D1-8B24-00A0C9068FF3}". W32/Trojan2.NOXC tries to create a connection with a remote server.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.dll File name: file.dll
Size: 110.59 KB (110592 bytes)
MD5: 183230563ca44a5e26cd9d319915f856
Detection count: 56
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: November 2, 2011
%UserProfile%\Local Settings\UPS.exe File name: %UserProfile%\Local Settings\UPS.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%UserProfile%\Local Settings\cisvc.exe File name: %UserProfile%\Local Settings\cisvc.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run UPS = "%UserProfile%\Local Settings\UPS.exe"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Cisvc = "%UserProfile%\Local Settings\cisvc.exe"
Loading...