Stekct

By Domesticus in Worms

Threat Scorecard

Threat Level: 50 % (Medium)
Infected Computers: 2
First Seen: May 18, 2012
OS(es) Affected: Windows

Stekct opens a backdoor that allows attackers to connect to the infected computer and perform numerous malicious actions such as dropping infectious files and running them, monitoring the IM programs and social networking websites for sending spam messages to the affected computer users' contacts. Stekct modifies the Windows Registry so that it can run automatically every time you start windows. Stekct inserts itself to the list of legitimate processes which become authorized to access the network just by altering another registry value. Stekct also attempts to block anti-virus software processes and services. Stekct attempts to terminate processes and delete all the related files. Get rid of Stekct before it harms your machine.Stekct is a worm that aims at using social networking web pages and instant messaging applications such as AIM, MSN, Yahoo! Messenger, Google Talk, ICQ, Skype, Windows Live Messenge and Facebook to distribute a message that carries a web-link to an infectious file. Stekct illustrates the following message on the compromised PC:

'HAHA LOL could this be you? hxxp://goo.gl/LFDt0?Facebook.com-IMG.JPG'

Stekct opens a backdoor that enables cybercriminals to contact the affected machine and conduct lots of harmful activities such as adding malevolent files and executing them, controlling the IM applications and social networking web pages in order to send spam messages to the victims' contact list. Stekct can modify the Windows Registry so that it can start automatically whenever you boot up windows. Stekct embeds itself to the list of genuine processes which become authorized to access the network just by changing another registry entry. Stekct also strives to block security software processes and services. Stekct strives to terminate processes and delete all the relevant files.

SpyHunter Detects & Remove Stekct

File System Details

Stekct may create the following file(s):
# File Name MD5 Detections
1. iqs.exe 6ad8969cf4fed4c7d47e92b5b7fcb1a4 2
2. %Windir%\MDM.EXE
3. file.exe 0d64f67af08848c0cfe0993efe56beb9 0
4. file.exe 72e8a4d4c8798ab5b0c7245d1fd6de26 0
5. file.exe 92e843961e9f1714647d5d9985c010ac 0
6. stixth7.bin ba7de7bb8972a269cff69eaa4de0309c 0

Registry Details

Stekct may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\mdm.exe" = "%Windir%\mdm.exe:*:Enabled:MSN Messenger"
Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Microsoft Firevall Engine" = "%Windir%\MDM.EXE"

Related Posts

Trending

Most Viewed

Loading...