Wednesday, May 5, 2010

Beware of new Spyware SSHNAS

This spyware will infect your pc by asking you to install the adobe flash player. McAfee SecurityCenter that comes with Alienware m11x confirm cannot clean this virus.

 

it create the following registry entry.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | LosAlamos
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSHNAS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSHNAS

 

and drop files

%windir%\msa.exe
%windir%\system32\sshnas.dll
%windir%\system32\sshnas21.dll
%windir%\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
%windir%\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

No comments: