Troj/Mdrop-CSW is a Trojan for the Windows platform.
Troj/Mdrop-CSW includes functionality to access the internet and communicate with a remote server via HTTP.
Troj/Mdrop-CSW communicates via HTTP with the following locations:
intelore . com
When Troj/Mdrop-CSW is installed the following files are created:
<Program Files>\Intelore\RAR-PR\rsproc.dll
<Program Files>\Intelore\RAR-PR\uninstall.exe
<Program Files>\Intelore\RAR-PR\unrpros.dll
<Program Files>\Intelore\RAR-PR\uraext2x.dll
<Program Files>\Intelore\RAR-PR\uraext3x.dll
<Program Files>\Intelore\RAR-PR\urapwd2x.dll
<Program Files>\Intelore\RAR-PR\urpwdr11rc16.exe
<Root>\downloader.exe.exe
<Root>\Setup.exe
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Intelore - RAR Password Recovery
HKCU\Software\Intelore
Troj/Mdrop-CSW provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "RAR Password Recovery v1.1 RC16 (remove only)".