Troj/Hasum-A

Category: Viruses and Spyware
Type: Trojan
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Hasum-A is a Trojan for the Windows platform.

Troj/Hasum-A may download and run files from a remote server, may open the default browser to pre-specified webapges, and may monitor computer usage.

The following registry entries are created to run code exported by the Trojan DLL on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
DLLName
<pathname of the Trojan executable>

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
startup
WACLEventStartup

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{B212D577-05B7-4963-911E-4A8588160DFA}
st3i

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
DLLName
<pathname of the Trojan DLL>

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
startup
WACLEventStartup

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}
z

Troj/Hasum-A is registered as a COM object, creating registry entries under:

HKCR\CLSID\{B212D577-05B7-4963-911E-4A8588160DFA}
HKCR\CLSID\{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}