Infostealer.Proxydown

By JubileeX in Stealers

Infostealer.Proxydown is a Trojan that steals computer data and the Internet Explorer's information and may add harmfulfiles on to the affected PC. While being run, Infostealer.Proxydown creates harmful files. Infostealer.Proxydown creates the registry entry so that it can launch automatically every time you boot up Windows. Infostealer.Proxydown modifies the registry entry to make changes to the settings of Internet Explorer. Infostealer.Proxydown checks the proxy configuration information on the targeted computer system. Infostealer.Proxydown connects google.com to create an Internet connection. Infostealer.Proxydown transmits all of the stolen information to certain distant locations.

SpyHunter Detects & Remove Infostealer.Proxydown

File System Details

Infostealer.Proxydown creates the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll		N/A
Name: %UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll Type: Dynamic link library Group: Malware file
2.	%Temp%\[RANDOM CHARACTERS FILE NAME].datce		N/A
Name: %Temp%\[RANDOM CHARACTERS FILE NAME].datce Group: Malware file
3.	%Temp%\[RANDOM CHARACTERS FILE NAME].tmp		N/A
Name: %Temp%\[RANDOM CHARACTERS FILE NAME].tmp Type: Temporary File Group: Malware file
4.	%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll144031u23.tmp		N/A
Name: %UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll144031u23.tmp Type: Temporary File Group: Malware file
5.	%Temp%\[RANDOM CHARACTERS]wg[RANDOM DIGIT].dat		N/A
Name: %Temp%\[RANDOM CHARACTERS]wg[RANDOM DIGIT].dat Type: Data file Group: Malware file
6.	7d95302e81c5a69fe18920f9d57c5644	7d95302e81c5a69fe18920f9d57c5644	0
Name: 7d95302e81c5a69fe18920f9d57c5644 MD5: 7d95302e81c5a69fe18920f9d57c5644 Size: 105.98 KB (105984 bytes) Computers: 0 Group: Malware file Last Updated: January 7, 2013
7.	21ac774a6717ec3e70de1e91324ffcc8	21ac774a6717ec3e70de1e91324ffcc8	0
Name: 21ac774a6717ec3e70de1e91324ffcc8 MD5: 21ac774a6717ec3e70de1e91324ffcc8 Size: 112.12 KB (112128 bytes) Computers: 0 Group: Malware file Last Updated: January 7, 2013
8.	wmshlp.dll	3ac94e32920b27b16fbcf8dc027cf054	0
Name: wmshlp.dll MD5: 3ac94e32920b27b16fbcf8dc027cf054 Size: 106.49 KB (106496 bytes) Computers: 0 Type: Dynamic link library Group: Malware file Last Updated: January 7, 2013

Registry Details

Infostealer.Proxydown creates the following registry entry or registry entries:

HKEY..\..\..\..{RegistryKeys}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\"DefaultConnectionSettings" = "[BINARY DATA]"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"TactXCI" = "rundll32.exe \"%UserProfile%\Application Data\Microsoft\CommonFiles\wmshlp.dll\" TactXCIHlp 137"