Trojan-Proxy.Win32.Cidra.d

The Trojan creates a SOCKS proxy server on a randomly chosen TCP port. The number of the open port and the victim machine

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following key from the system registry: [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "UsbD" = "

   This Trojan program turns the victim machine into a proxy server. It is a Windows PE EXE file. It is 27,136 bytes in size. It is packed using UPX. The unpacked file is approximately 60KB in size.

   Installation

   The Trojan adds the following parameter to the Window system registry in order to ensure that its executable file will be launched automatically:

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "UsbD" = "<path to Trojan exeuctable file>" Payload