Symptoms

Removal instructions:

Analyzed By

Technical Description:

   Once executed, file starts a new process with the same name. It injects an executable into the process memory, and then it drops it intro the system file,called netmon.exe. It order to ensure that it`s executed every time the system starts up, it creates a registry key entry  HKLM\SOFTWARE\Microsoft\CurrentVersion\Run with value of the executable file that is dropped intro system file.
 
  Netmon.exe drops a driver into %system%\drivers folder, called sysdrv32.sys, that is registered as a service. For spreading, it scans copies itself on removable drives,  being executed using autorun.inf file.

  To protect himself, it is hidden from user mode.