TrustNinja and TrustWarrior

25 August 2009 Rogue 1 Comment

TrustNinja and TrustWarrior, others call it Trust Ninja is a misleading application that comes from the same author who created SaveKeep. TrustNinja has no difference from previous variants. They often originate from Trojan that is looking for weak spot on computer to gain an access. Once Trojan is inside, it immediately setup a copy of TrustNinja. Expect a redundant pop-up of alert
messages and task bar warning that continuously remind users for detected threats when invasion is completed. Then, it will advise to get a register copy of this bogus program through their payment facility online.

TrustNinja’s mission will not end by just giving you tons of annoyances. It creates a range of computer problems that ranges from medium damages like registry modification to severe destruction that makes the PC unusable. All of these abnormalities done to your system roots to a single objective of malware authors, and that is to steal money from your credit card
account.

If you decided that it is about time to eliminate TrustNinja from your PC, then you can proceed with the instructions below. You do not have to be a skilled technical person to carry out the
procedures.

Screen Shot Images:

 

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

[expand title="View More" swaptitle="Hide This"]

Characteristics (Analysis)
The malware will automatically load on every Windows boot-up. The following registry entry made this course possible:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “TrustNinja“

Malware Behavior
Once TrustNinja and TrustWarrior is activated, it scans the system for viruses and instantly reports a number of infections. The program is likely to remove these threats, but it will not proceed until the registered version is purchase.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "TrustNinja"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustNinjaSvc
HKEY_CURRENT_USER\Software\TrustNinja
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustNinja
HKEY_LOCAL_MACHINE\SOFTWARE\TrustNinja
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TRUSTNINJASVC

Associated Files and Folders:

C:\Documents and Settings\All Users\Desktop\TrustNinja.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\TrustNinja
C:\Documents and Settings\All Users\Start Menu\Programs\TrustNinja\1 TrustNinja.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\TrustNinja\2 Homepage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\TrustNinja\3 Uninstall.lnk
C:\Program Files\TrustNinja Software
C:\Program Files\TrustNinja Software\TrustNinja
C:\Program Files\TrustNinja Software\TrustNinja\license.txt
C:\Program Files\TrustNinja Software\TrustNinja\TrustNinja.exe
C:\Program Files\TrustNinja Software\TrustNinja\TrustNinjaSvc.exe
C:\Program Files\TrustNinja Software\TrustNinja\uninstall.exe 

1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of TrustNinja

3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.

4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.

Online Virus Scanner:

Another way to remove TrustNinja without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found here or on websites of legitimate anti-virus and security provider.

5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished you may now restart the computer in normal mode.

Automatic Removal of TrustNinja

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.