Trojan Procedure

Trojan goes into computer passes client and server. When a victim (without aware) running the computer, assailant will use client for connection with server and put into using trojan.
When the server (computer victim ) runing by trojan usually try to hide self in a certain place in computer system, then begin to "listening" at several port to do connection, modification registry or autostarting.
A large part trojan will use method auto-starting that is trojan that automatically active when the computer was turned on. Although computer is turn off and then turn on again, trojan can works to return and assault computer victim.

Modification files system that done by trojan.

1. Autostart folder.
Reside in c: \windows\start menu\programs\starup.
2. win.ini.
This File system use load=trojan. exe and run=trojan. exe. to runing trojan.
3. system.ini.
Use shell=exploler. exe trojan. exe that be executed every will runing exploler. exe.
4. wininit.ini. A large part program installer using this file. when be runing be auto-delete.
5. Act to like batch normal file. When added @trojan. exe so can hide the victim.
6. autoexec. bat. This file can be used for method auto-starting with turn on c: \trojan.exe.
7. config.sys. This file also can be used as auto-starting by trojan.
8. Exploler Starup. This file is method auto-starting for windows 95,98, me. If c:\exploler.exe
exist, so will replace general that is c:\windows\exploler.exe.

Registry often done in method auto-starting.

1. HKEY_LOKAL_MICHINE\Software\Microsoft\Windows\CurrentVersion\Run.
“info” = “C:\directory\Trojan.exe.”
2. HKEY_LOKAL_MICHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.
“info” = “C:\directory\Trojan.exe.”
3. HKEY_LOKAL_MICHINE\Software\Microsoft\Windows\CurrentVersion\RunService
“info” = “C:\directory\Trojan.exe.”
4. HKEY_LOKAL_MICHINE\Software\Microsoft\Windows\CurrentVersion\RunServiceOnce.
“info” = “C:\directory\Trojan.exe.”
5. HKEY_LOKAL_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run.
“info” = “C:\directory\Trojan.exe.”
6. HKEY_LOKAL_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\RunOnce.
“info” = “C:\directory\Trojan.exe.”
7. Registry Shell Open.
HKEY_CLASS_ROOT\exefile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\classes\exefile\shell\open\command
If at registry this is found trojan. exe”%1%”, so be used as auto-starting by trojan.
8. ICQ Net detection method.
HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps.
9. AvtiveX Component
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Component\KeyName.
StubPath=C:\directory\Trojan.exe