Virus.Win32.Nsag.a
| Alert Level : | High |
| Discovered: | Jul 04 2005 |
| Tag: | Executable File and Boot Viruses |
| Discoverer and Source: | http://www.kaspersky.com/ |
Malware Behavior and Technical Description
Virus.Win32.Nsag.a is a detection for an infected copy of the Windows' wininet.dll file. The purpose of this infection is to transfer calls to the HttpSendRequest function to a malicious .dll file.
There are several pieces of malware which install Virus.Win32.Nsag.a, (often referred to as Smitfraud). Smitfraud and Nsag are quite similar, and have the following in common:
When the malware which installs Nsag is run, two main .dll files are dropped into the system directory.
One of these .dll files is around 7 KB in size, and is usually named oleadm.dll. It serves as AdWare/Trojan-Downloader. Normally this file is detected as Trojan-Downloader.Win32.Agent.ns.
The other file however, oleadm32.dll, is an infected copy of the system's wininet.dll file, an important Windows file. In some cases infection corrupts the file, which will result in a crash of explorer.exe when the file is loaded.
The malware uses a technique to ensure that oleadm32.dll will replace the system's wininet.dll file without warning when the infected system is restarted.
There are quite a few variants of Smitfraud. They are best known for altering the desktop wallpaper. In most cases the changed wallpaper displays a message about a 'Trojan-Spy.HTML.Smitfraud.c infection'.
These wallpapers are dropped into the system directory as ws.bmp, which will be detected by Kaspersky Anti-Virus as not-virus:BadJoke.Win32.Nsag.a
Removal instructions0
Removal Virus.Win32.Nsag.a instructions:
- Make sure Kaspersky Anti-Virus is up to date.
- Perform a full system scan and disinfect or delete all objects detected as infected.
- Navigate to %sysdir% (Most likely C:\Windows\System32)
- Find wininet.dll and rename it to wininet.dl
- Wait a few moments. A new, clean version of wininet.dll should appear
- Reboot the system and disinfect or delete the infected wininet.dl file
Need help? Live computer support via remote at SupportSpace |
