TrustNinja Description

TrustNinja (also known as Trust Ninja) is a fake optimization tool presented as a useful program in order to gain the trust of the user. TrustNinja must be installed manually, and once active, begins display fake infection results in order to trick the user into believing that the computer has been compromised. The user is then prompted to purchase the commercial version of TrustNinja in order to combat these threats or fix the various problems.

Type: Rogue AntiSpyware Programs

How Can You Detect TrustNinja?

TrustNinja Technical Report

As new TrustNinja details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following TrustNinja files with its MD5s were created in the system:

TrustNinja has typically the following processes in memory:

• %ProgramFiles%\TrustNinja Software\TrustNinja\uninstall.exe
• TrustNinjaSvc.exe
• %ProgramFiles%\TrustNinja Software\TrustNinja\TrustNinjaSvc.exe
• %Temp%\nsm2.tmp\nsSCM.dll
• %ProgramFiles%\TrustNinja Software\TrustNinja\TrustNinja.exe
• %Temp%\nsm2.tmp\nsProcess.dll
• TrustNinja.exe

TrustNinja created the following directories, files, paths:

• %ProgramFiles%\TrustNinja Software

TrustNinja creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\TrustNinja
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “TrustNinja”
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TRUSTNINJASVC\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustNinjaSvc\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustNinjaSvc\Enum
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustNinja
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustNinjaSvc
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TRUSTNINJASVC\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TRUSTNINJASVC\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustNinjaSvc\Security
• HKEY_CURRENT_USER\Software\TrustNinja
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustNinjaSvc
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TRUSTNINJASVC
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TRUSTNINJASVC\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustNinjaSvc\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TRUSTNINJASVC

Important Article Disclaimer