Troj/Prorat-R

Please follow the instructions for removing Trojans.

Troj/Prorat-R is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/Prorat-R includes functionality to send notification messages to remote locations.

When first run Troj/Prorat-R copies itself to:

<Windows>\services.exe
<System>\sservice.exe
<System>\fservice.exe

and creates the following files:

<Windows>\ktd32.atm
<System>\wininv.dll
<System>\winkey.dll

The file wininv.dll is detected as Troj/Prorat-C and the file winkey.dll is detected as Troj/Prorat-D.

The following registry entries are created to run sservice.exe and fservice.exe on startup:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\(5Y99AE78-58TT-11dW-BE53-Y67078979Y)
StubPath
<System>\sservice.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
DirectX For Microsoft® Windows
<System>\fservice.exe

The following registry entry is changed to run fservice.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe <System>\fservice.exe

(The default value for this registry entry is "Explorer.exe".)

Troj/Prorat-R sets the following registry entries, disabling the automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\srservice
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates the Microsoft Internet Connection Firewall (ICF).

Registry entries are created under:

HKCU\Software\Microsoft DirectX\WinSettings\