Backdoor.Proxybox

Backdoor.Proxybox Description

Backdoor.Proxybox is a backdoor Trojan able to open a back door and allow a hacker to gain remote access on poorly protected computers. Trojans are stealth and can not only open a port to communicate with a C&C server, but can also make systems changes comparable to that of a programmer or IT expert. Trojans use common vectors to gain deceptive entry, often hiding behind faces (i.e. interfaces and prompts) claiming to be innocent or of great help. Studies show most malware invasions occur when victims click too fast and fail to fortify their systems with proper security. After slipping inside, Backdoor.Proxybox will set up shop by executing files, adding registry entries, including one that runs the malicious executable each time Windows is booted, and by performing its main function, opening a backdoor. An open port could allow more malware to be downloaded, such as a keylogger or a rogue security program.

Backdoor.Proxybox is without an interface and was intended to work resident in the background. If your system is suddenly running slow, web pages freezing up or you've been notified Backdoor.Proxybox is present, you should react swiftly by using a stealth anti-malware to uproot and permanently remove all hidden malware.

Aliases: Generic Malware [Panda], BackDoor.Agent.ARMF [AVG], W32/Agent.DEOE!tr.rkit [Fortinet], Trojan.Rootkit [Ikarus], Trojan.Win32.Generic.12F1F180, Trojan.MSA.22815, Trojan/Win32.Agent.gen [Antiy-AVL], Rootkit.Agent.pxy, Trojan.Rootkit!IK, TR/Rootkit.Gen [AntiVir], Trojan.Win32.Generic!BT, Trojan.NtRootKit.14541 [DrWeb], UnclassifiedMalware [Comodo], Mal/Generic-L [Sophos] and Trojan.Win32.A.RT-Agent.21504.D.

Technical Information

File System Details

Backdoor.Proxybox creates the following file(s):
# File Name Size MD5 Detection Count
1 \??\c:\users\jerry n kim\appdata\roaming\adobe\rxsupply.sys 21,504 86908d0c072ce28a7650b78bab5a06e5 54
2 %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.dll N/A
3 %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\rxsupply.sys N/A
4 %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\fs.cfg N/A
5 7_24e5ba.exe 220,672 24e5ba364afcaa1a4754a8902301c312 0

Registry Details

Backdoor.Proxybox creates the following registry entry or registry entries:
RegistryKey
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"Type" = "110"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\"netsvc" = "SPService, J"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Parameters\"ServiceDll" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.dll""
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"0" = "Root\LEGACY_SHTST\0000"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{96AFBE69-C3B0-4b00-8578-D933D2896EE2}" = "sp"
HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}\InProcServer32\"(Default)" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.DLL"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"Count" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ObjectName" = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\svchost.exe" = "%System%\svchost.exe:*:Enabled:svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\"netsvc" = "SPService, m"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ImagePath" = "%System%\svchost.exe -k netsvc"
"{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
HKEY_CLASSES_ROOT\sp\CLSID\"(Default)" = "{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"NextInstance" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ErrorControl" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\svchost.exe" = "%System%\svchost.exe:*:Enabled:svchost.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FsFilter\"ImagePath" = "%SystemDrive%\Documents and Settings\All Users\Application Data\adobe\rxsupply.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Parameters\"ServiceDll" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\sp.DLL"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\sp\"(Default)" =
HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}\InProcServer32\"(Default)" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\sp.DLL"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"Start" = "2"

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.


HTML is not allowed.