Troj/JD-A

Please follow the instructions for removing Trojans.

Troj/JD-A is a password stealing Trojan.

Troj/JD-A can arrive as a result of web browsing. Visiting certain web sites may initiate the download process.

Troj/JD-A includes functionality to silently download, install and run new software.

When Troj/JD-A is installed the following files are typically created:

<Temp>\upxdnd.dll
<Temp>\upxdnd.exe
<Root>\Syswm1i\Ghook.dll
<Root>\Syswm1i\svchost.exe
<Windows>\cmdbcs.exe
<Windows>\mppds.exe
<Windows>\msccrt.exe
<Windows>\nortonp.exe
<Windows>\winform.exe
<System>\225B4074.exe
<System>\cmdbcs.dll
<System>\E8CA85CC.DLL
<System>\E8CA85CC.EXE
<System>\E8CA85CCT.EXE
<System>\jdsfdutj.dat
<System>\mppds.dll
<System>\msccrt.dll
<System>\nortonp.dll
<System>\winform.dll

The following registry entries are created to run Troj/JD-A on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
nortonp
<Windows>\nortonp.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
cmdbcs
<Windows>\cmdbcs.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mppds
<Windows>\mppds.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
msccrt
<Windows>\msccrt.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
upxdnd
<Temp>\upxdnd.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winform
<Windows>\winform.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
333
<Root>\Syswm1i\svchost.exe

The file E8CA85CC.EXE is registered as a new system driver service named "E8CA85CC", with a display name of "E8CA85CC" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\E8CA85CC

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows
PopupMgr
no