TROJ_PONMOCOP

TROJ_PONMOCOP is a Trojan that induces the unwanted printing routine on the corrupted PC and displays disturbing pop-up ads. TROJ_PONMOCOP code encompasses an encrypted portion, which is loaded and decrypted into memory. When decrypted, it becomes a new binary file that is UPX-packed, and will corrupt the routines from then on. This new binary also encompasses an encrypted code, which needs decryption keys from parameters found in the corrupted PC, for instance, ftCreationTime & ftLastAccessTime of %Windows%\system32 and System Volume Information folder, and the serial number of the hard drive in order to decrypt itself. If the decrypted code is a legitimate binary file, it again sends the control to this newly-created binary. If not, then the routine of TROJ_PONMOCOP will not continue which means that the binary may be unique for each of the targeted computer. All these actions are performed in memory, which means there are no downloaded files. Then, the certain registry keys are being checked by TROJ_PONMOCOP to decrypt additional binaries in memory. These registry keys are based on the infected computer's processor/OS.

Table of Contents

1

SpyHunter Detects & Remove TROJ_PONMOCOP