Threat Database Trojans Trojan SEFNIT

Trojan SEFNIT

By Domesticus in Trojans

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 24,917
First Seen: November 22, 2011
Last Seen: August 26, 2025
OS(es) Affected: Windows

Trojan SEFNIT is a browser hijacker Trojan that affects Mozilla and Internet Explorer. Trojan SEFNIT spreads via spam email messages, file-sharing networks and instant messaging applications. Trojan SEFNIT may also come bundled with shareware programs that are hosted on file-sharing networks. Trojan SEFNIT blocks your activity on search engines or redirects your search results to malicious websites. Trojan SEFNIT creates a .dll file and adds it into processes of Mozilla and Internet Explorer. Trojan SEFNIT also creates mutex and startup registry entries. Trojan SEFNIT runs every time you start up Windows. Remove Trojan SEFNIT immediately after detection.

SpyHunter Detects & Remove Trojan SEFNIT

File System Details

Trojan SEFNIT may create the following file(s):
# File Name MD5 Detections
1. 81D0.tmp bf6054d16bbce96159f8cbbde8ea80b3 2,186
2. wnns.exe 2c3a9f60a6a097ba7bc769a51479fe41 251
3. BleServicesCtrl.exe 283bc11ed03732ba1055aaced9f7ced8 206
4. TrustedInstaller.exe a472021e21a13dc3081f99f53a5461a6 78
5. updater.dll b99fe4761f454b4e25e86152b4b51784 41
6. wins.exe 7d60bc72c525b377068706c235f9cdc5 35
7. stub.exe 24c2573af8b38dc88fb933ae12c9e40b 2
8. %AppData%\audiop2psound\audiop2psound.dll
9. %UserProfile%\Application Data\acxmapdb\AgerePadClock.dll
More files

Registry Details

Trojan SEFNIT may create the following registry entry or registry entries:
Regexp file mask
%APPDATA%\Microsoft\ApplicationManager\stub.exe
%APPDATA%\Updater\updater.dll
%WINDIR%\system32\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe
%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"cleansweep.exe" = "rundll32.exe "%AppData%\audiop2psound\audiop2psound.dll"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"AgerePadClock" = "rundll32.exe "%USERAPPDATA%\acxmapdb\AgerePadClock.dll",isaAuthenticationInit SyncWISupport"
HKEY_CLASSES_ROOT\CLSID\{4fc3d0c1-7d9a-4c56-aa94-d5eb3997e46e}

Related Posts

Trending

Most Viewed

Loading...