McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

This trojan downloads its update from the internet.  It attempts to shut down other anti spyware applications.

Upon execution, the trojan connects to a specific website and downloads executable to local machine.  The file name of the executable varies, it can be one of the following:

• prhtect.exe
• prgtect.exe
• prktect.exe
• ...

The following Registry key  is added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  "pr*tect" = "(path)\pr*tect.exe"

Where * varies as mentioned above.

Symptoms

Existence of files and registry key mentioned above.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This trojan downloads its update from the internet.  It attempts to shut down other anti spyware applications.

Upon execution, the trojan connects to a specific website and downloads executable to local machine.  The file name of the executable varies, it can be one of the following:

• prhtect.exe
• prgtect.exe
• prktect.exe
• ...

The following Registry key  is added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  "pr*tect" = "(path)\pr*tect.exe"

Where * varies as mentioned above.

Symptoms

Symptoms -

Existence of files and registry key mentioned above.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A