Trojan.Smaxin

24 November 2010 Trojan 1 Comment

Trojan.Smaxin is a computer Trojan Horse that will when executed will connect to a remote server and download additional threats. Trojan.Smaxin can embed itself on a legitimate calc.exe file. It will also reduce security settings by ending process that were found related to antivirus programs.

Technical Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Manual Removal of Trojan.Smaxin:

1. Temporarily Disable System Restore (Windows Me/XP/Vista/7) . [how to]
2. Update the virus definitions.
3. Restart Windows in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. [how to edit registry]
6. Exit registry editor and restart Windows.

Online Virus Scanner:
Another way to remove a virus without the need to install additional anti-virus application is to perform a thorough scan with free Online Virus Scanner that can be found here or on websites of legitimate anti-virus and security provider.

Technical Details and Additional Information:

Other functionalities of this Trojan:
- Download and execute files
- Block Internet access
- Redirect predefined URL to other web sites
- Embed snippets to online banking web sites to steal information

Malicious Files Added by Trojan.Smaxin:
%UserProfile%\Microsoft\V3smx4pnp.dll
%UserProfile%\Microsoft\[random].dll
%UserProfile%\Microsoft\V3smx4pnp.log
%UserProfile%\Microsoft\[random].log

Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”V3smx4pnp” = “rundll32.exe “C:\Documents and Settings\Administrator\Microsoft\V3smx4pnp.dll”, Launch”