Win32/TrojanClicker.Small.KJ [Threat Name] go to Threat

Win32/TrojanClicker.Small.KJ [Threat Variant Name]

Category trojan
Aliases Trojan-Clicker.Win32.Small.kj (Kaspersky)
  AdClicker.b (McAfee)
Short description

Win32/TrojanClicker.Small.KJ is a trojan that repeatedly tries to connect to various web pages.

Installation

When executed, the trojan copies itself into the %windir% folder using one of the following file names:

  • svchost.exe
  • service32.exe

Another file is dropped in the same folder.


Its filename may be one of the following:

  • scrss32.dll
  • spoolsv32.dll
  • syshost.dll
  • syst32.dll

Size of the file is approximately 5 KB .


In order to be executed on every system start, the modifies the following Registry key:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­policies\­Explorer\­Run]

The entry added contains path to trojan executable.

Other information

The trojan contains a list of URLs.


It opens these using the Explorer .


The trojan might attempt to hide its presence in the system by modifying several functions of the following library:

  • ntdll.dll

Please enable Javascript to ensure correct displaying of this content and refresh this page.