2

I recently noticed "something" hijacking Google search results (on Firefox!) and so I decided to run a scan by Malwarebytes.

Sure enough, it found a Trojan.Agent with the following information:

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsyncMapLite (Trojan.Agent)
-> Value: AsyncMapLite
-> Data: rundll32.exe "C:\Users\WinWin\AppData\Local\Nativeobjdrv\AsyncMapLite.dll",rasGLLite lanAuthenticationlib

Memory Modules Infected:

c:\Users\WinWin\AppData\Local\nativeobjdrv\asyncmaplite.dll (Trojan.Agent)

Files Infected:

c:\Users\WinWin\AppData\Local\nativeobjdrv\asyncmaplite.dll (Trojan.Agent)

Well, I Googled asyncmaplite and couldn't find anything about it.

So, I suspect the name is totally irrelevant and may be mutating... But since Malwarebytes did find it, there must be some information about it somewhere.

Any idea what type of Trojan this is and how I can find more information about it?

UPDATE (Sep 19): After tracking my system for a while, this Trojan.Agent re-appeared -- with a different name: iecrtlog. It's clear now that the name is meaningless, as it keeps mutating.

But.. even after MBAM cleanup, it happens to be leaving a "souvenir" in the registry:

[HKEY_CURRENT_USER\Software\Nativeobjdrv]
"gFtOQZs"="TeL90WPbzngPabEduP5DI0"
"lgT"=dword:045371ea
"hUV"=dword:00004e8d

And:

[HKEY_CURRENT_USER\Software\iecrtlog]
"mUuwFxgJ"="TeL90WPbzngPabEduP5DI0"
"xifo"=dword:0487c61a
"imRTPr"=dword:0000526d

Which shows, again, that everything about this Trojan keeps mutating, except for the signature string "TeL90WPbzngPabEduP5DI0".

Interesting.

Improve this question
5
  • 1
    Have you tried deleting the file infected file, rebooting and seeing if the hijacking continues?
    – Paul
    Aug 10, 2011 at 23:56
  • 1
    @Paul Malwarebytes was kind enough to do all of that for me: delete the infected file, remove the registry entry and reboot. So far so good, but I need to know whether I am going to be surprised a few days down the road...
    – WinWin
    Aug 11, 2011 at 0:01
  • 1
    Totally agree, it's good to be prepared. I can't find anything on any search engine either on any of the search terms in your code. Have you made sure the registry entry is also deleted?
    – Paul
    Aug 11, 2011 at 0:17
  • 1
    @Paul Yes, I made sure the registry entry is deleted and I check it periodically to see whether it re-appears. The nasty thing about this Trojan is that it doesn't even require Administrator access...
    – WinWin
    Aug 11, 2011 at 0:38
  • Hopefully someone more knowledgeable can help you. You've already taken the steps I would have done. Sorry for not being able to help more, good luck.
    – Paul
    Aug 11, 2011 at 0:40

1 Answer 1

Reset to default
2

If Malwarebytes found it, chances are that it found what was inside the file at issue, and not the name of the file. Like you said, it's probably mutating, in this case not using a random string of characters, but some random computer characters, Native obj drv async map lite.

As with any viruses, you're never 100% sure if it will show backup on your system if you remove the virus. Do the scan in another week or so even if you don't have any symptoms with an updated malwarebytes definition and see if you have anything new. If you do, you might think about nuking your OS and doing a reinstall.

Improve this answer
1
  • 1
    +1 for confirming what I have known. Can't accept the answer though, because the question was specifically about information about this particular Trojan.
    – WinWin
    Sep 19, 2011 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .