Threat Encyclopedia

Win32/TrojanProxy.Small.NP is a trojan that is used for spam distribution. It uses techniques common for rootkits. When executed, the trojan copies itself into the: %windir% folder with the following file names: The file is then executed. The trojan deletes the original file.

The following file is dropped into the %system%\drivers\ folder: Installs the following system drivers: In order to be executed on every system start, the trojan sets the following Registry entry: The trojan may set the following Registry entries: The variable %number% stands for a variable 12 digit number.

The following Registry entry is set: This prevents Windows from displaying the Security Warning when launching a file downloaded from the Internet. The trojan can be used for sending spam.

The trojan is sent data and commands from a remote computer or the Internet. The HTTP protocol is used in the communication.

The recipient address is one of the following: A string with variable content is used instead of %variable% .

The SMTP protocol is used. The following services are disabled:

The trojan replaces the following file by one downloaded from the Internet: It contains the following text: This way the trojan blocks access to specific websites.

The trojan hides files and processes which contain one of the following strings in their name: The trojan hides Registry entries which contain one of the following strings in their name:

The trojan opens a random TCP port.

The trojan can download and execute a file from the Internet. The trojan contains an URL address.