Internet Security Threats

Trojan-Proxy.Win32.Daemonize.a

RISK LEVEL:2

This Trojan launches a proxy server on the victim machine without the user'sknowledge or consent. This makes it possible for a remote malicious user toappear as though his actions are being carried out on the infected machine.

The Trojan is a Windows PE EXE file. It is written in C++. It has the followingcomponents: svchostñ.exe – 19,456 bytes in size; svchosts.exe –25,088 bytes in size.

This Trojan launches a proxy server on the victim machine.

The svchosts.exe process launches an HTTP proxy server on TCP port 3128. The svchostc.exe process will, in turn, launch a SOCKS5 proxy server on TCPport 1080.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate the Trojan processes, which arelikely to have the following names:

   svchosts.exesvchostc.exe

2. Delete the original Trojan files (the location will depend onhow the program originally penetrated the victim machine).
3. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).