TROJ_DROPR.SMIG

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It deletes itself after execution.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Autostart Technique

This Trojan registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\aspimgr

Dropping Routine

This Trojan drops the following files:

• %System%\aspimgr.exe - detected as TROJ_ASPROX.AK

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This Trojan drops the following file(s)/component(s):

• %Windows%\ws386.ini - non-malicious file

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It does the following:

• It tries to open the following files:
  
  • %System%\iN91.dll
  • %System%\cmdial32.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It deletes itself after execution.