Mal/TibsPak

By ESGI Advisor in Backdoors

Mal/TibsPak is a mischievous backdoor trojan infection that runs in the background and enables remote access to the targeted computer system. Mal/TibsPak is installed on a compromised PC without a victim's knowledge. Mal/TibsPak won't let you uninstall it instead of showing fake security alert. Mal/TibsPak comes bundled with malicious software, so it is often used to advertise rogue antivirus software, spyware, etc. Mal/TibsPak should be removed as early as possible when it is detected on a computer system.

File System Details

Mal/TibsPak may create the following file(s):

Expand All | Collapse All

#	File Name	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	%Temp%\g8ngajqe.bat
Name: %Temp%\g8ngajqe.bat Type: Batch file
2.	%Temp%\qtfcyyp.exe
Name: %Temp%\qtfcyyp.exe Type: Executable File
3.	%Windir%\Temp\p0uj78n6a.exe
Name: %Windir%\Temp\p0uj78n6a.exe Type: Executable File
4.	%Windir%\Temp\Managee.exe
Name: %Windir%\Temp\Managee.exe Type: Executable File
5.	%Windir%\Temp\qtfcyyp.exe
Name: %Windir%\Temp\qtfcyyp.exe Type: Executable File
6.	%Temp%\4wa3x6d21.bat
Name: %Temp%\4wa3x6d21.bat Type: Batch file
7.	%Temp%\MouseDriver.bat
Name: %Temp%\MouseDriver.bat Type: Batch file
8.	%Temp%\ydky9kv.exe
Name: %Temp%\ydky9kv.exe Type: Executable File
9.	%Windir%\Temp\y4xjfgfi.exe
Name: %Windir%\Temp\y4xjfgfi.exe Type: Executable File
10.	%Windir%\Temp\ydky9kv.exe
Name: %Windir%\Temp\ydky9kv.exe Type: Executable File
11.	%AppData%\updates\updates.exe
Name: %AppData%\updates\updates.exe Type: Executable File
12.	%System%\Nwsapagents.dll
Name: %System%\Nwsapagents.dll Type: Dynamic link library
13.	%Temp%\z1vdxih4w.exe
Name: %Temp%\z1vdxih4w.exe Type: Executable File
14.	%Temp%\kmoj0k5ur.exe
Name: %Temp%\kmoj0k5ur.exe Type: Executable File
15.	%Windir%\Temp\Plug.bat
Name: %Windir%\Temp\Plug.bat Type: Batch file
16.	%Windir%\Temp\x2fldzww.exe
Name: %Windir%\Temp\x2fldzww.exe Type: Executable File
17.	%Windir%\Temp\MouseDriver.bat
Name: %Windir%\Temp\MouseDriver.bat Type: Batch file
18.	%Windir%\Temp\mlog
Name: %Windir%\Temp\mlog
19.	%System%\fl8uphp.log
Name: %System%\fl8uphp.log
20.	%Temp%\1avs.log
Name: %Temp%\1avs.log
21.	%Windir%\Temp\1avs.log
Name: %Windir%\Temp\1avs.log
22.	%System%\31rvuk6.log
Name: %System%\31rvuk6.log

Registry Details

Mal/TibsPak may create the following registry entry or registry entries:

HKEY..\..\..\..{RegistryKeys}

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWSAPAGENT

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWSAPAGENT\0000

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWSAPAGENT

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nwsapagent

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriver\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug Manager

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nwsapagent\Enum

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MouseDriver

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Plug Manager\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Plug Manager

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriver

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nwsapagent\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWSAPAGENT\0000

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWSAPAGENT\0000\Control

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MouseDriver\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Enum

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nwsapagent\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWSAPAGENT\0000\Control

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug Manager\Security

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Mal/TibsPak

File System Details

Registry Details

Submit Comment

Trending

Rzfu Ransomware

'YouPorn' Email Scam

Rzkd Ransomware

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen