Avira Virus Lab


  • Name
  • Date discovered
    Feb 25, 2016
  • Type
  • Impact
  • Reported Infections
  • Operating System
  • VDF version (2016-02-24 15:42)

Stay safe from all these threats with Avira Free Antivirus.

Avira Free Antivirus Download Free

The term 'TR' denotes a trojan horse that is able to spy out data, violate your privacy, or perform unwanted modifications to the system.

The file can be used by rogue users or malware to lower security settings.

Operating System: Microsoft Windows.

  • VDF (2016-02-24 15:42)
  • Aliases
    Avast: Win32:Malware-gen
    Dr. Web: Trojan.Click3.12222
    Microsoft: Trojan:Win32/Necurs.A
    G Data: Trojan.GenericKD.3065485
    Kaspersky Lab: Trojan.Win32.Waldek.dst
    Bitdefender: Trojan.GenericKD.3065485
    ESET: Win32/TrojanDownloader.Necurs.B trojan
  • Files
    The following copies of itself are created:
    • %WINDIR%\Installer\{C6BDC445-7A8D-BF56-7587-6C1155762A63}\syshost.exe
    • %WINDIR%\Installer\{C6BDC445-7A8D-BF56-7587-6C1155762A63}\syshost.exe
    The following files are renamed:
    • %WINDIR%\Installer\{C6BDC445-7A8D-BF56-7587-6C1155762A63}\syshost.exe
  • Injections
    • %all running processes%
  • Registry
    The following registry entries are added:
    • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\syshost32] "Type" = dword:00000010 "Start" = dword:00000002 "ErrorControl" = dword:00000000 "ImagePath" = ""%WINDIR%\Installer\{C6BDC445-7A8D-BF56-7587-6C1155762A63}\syshost.exe" /service" "ObjectName" = "LocalSystem"
    • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\syshost32\Security] "Security" = %hex values%
    • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\syshost32\Enum] "0" = "Root\LEGACY_SYSHOST32\0000" "Count" = dword:00000001 "NextInstance" = dword:00000001
    • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent] @ = dword:00000012
    • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\UserFaults] "C:\\WINDOWS\\PCHealth\\ErrorRep\\UserDumps\\svchost.exe.20160225-115610-00.mdmp" = %hex values%
    • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck" = "%systemroot%\system32\dumprep 0 -u"

Help make the web safer by sending us suspicious files/URLs to analyze

Submit your file/URL or Go to support.avira.com

Why submit a suspicious file?

If you encountered a suspicious file or website that’s not in our database, we’ll analyze it and determine whether it’s harmful. Our findings are then pushed out to our millions of users with their next virus database update. If you have Avira, you’ll get that update too. Don’t have Avira? Get it on our homepage.