The file NSF.EXE is identified as a virus dropper.
The dropper NSF.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file NSF.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the NSF.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the NSF.EXE process and delete the file NSF.EXE.
Malware Analysis of NSF.EXE
Full path on a computer: %SysDir%\nsf.exe
Detected by UnHackMe:
NSF.EXE
Default location: %SysDir%\nsf.exe
Removal Results: Success
Number of reboot: 1
NSF.EXE is known as:
Trojan.Ardamax.xzjct, W32.TrojanX.ESFA, not-a-virus:Monitor.Ardamax.cip, Tool.SafeModeDisabler.1, Ardamax, TR.Ardamax.D, No Safe Mode, W32.Trojan.WRUI-8123, Win32.NoSafeMode.A, not-a-virus:Monitor.Ardamax, HackTool.AACP, Monitor.Ardamax.cip
NSF.EXE hash:
- MD5: e6d58e0a4511695312f13d1b9f154187
How to quickly detect NSF.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\svchost: “C:\abwvrpcm\svchost.exe”
- HKLM\System\CurrentControlSet\Services\NIaSvc\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
- HKLM\System\CurrentControlSet\Services\NIaSvc\Type: 0×00000010
- HKLM\System\CurrentControlSet\Services\NIaSvc\Start: 0×00000002
- HKLM\System\CurrentControlSet\Services\NIaSvc\ErrorControl: 0×00000001
- HKLM\System\CurrentControlSet\Services\NIaSvc\ImagePath: “%SysDir%\svschost.exe”
- HKLM\System\CurrentControlSet\Services\NIaSvc\DisplayName: “Network Locatlon Awareness”
- HKLM\System\CurrentControlSet\Services\NIaSvc\ObjectName: “LocalSystem”
- HKLM\System\CurrentControlSet\Services\NIaSvc\Description: “Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to starts.”
Folders:- C:\Documents and Settings\LocalService\Application Data\WinRAR
- C:\abwvrpcm
- C:\plbbqirj
- C:\ProgramData
- C:\ProgramData\cbojrhub
- C:\ProgramData\kxhafmyp
- C:\ProgramData\rkbttpwo
- C:\ProgramData\stppthmain
- C:\ProgramData\tklidtjy
Files:- %Common Desktopdirectory%\omixdmvn.txt
- %Common Desktopdirectory%\whrryggn.bat
- %SysDir%\cfwin32.dll
- %SysDir%\csrss32.dll
- %SysDir%\csrss64.dll
- %SysDir%\default2.sfx
- %SysDir%\NoSafeMode.dll
- %SysDir%\nsf.exe
- %SysDir%\sdelete.dll
- %SysDir%\svschost.exe
- C:\abwvrpcm\svchost.exe
- C:\plbbqirj\dc.exe
- C:\ProgramData\cbojrhub\svchost.exe
- C:\ProgramData\kxhafmyp\svchost.exe
- C:\ProgramData\rkbttpwo\nprkyfbl.dlls
- C:\ProgramData\rkbttpwo\qqcrwxmn.dlls
- C:\ProgramData\stppthmain\stppthmain.dll
- C:\ProgramData\tklidtjy\eifiodcn.dll
- C:\ProgramData\tklidtjy\eifiodcn.dll.dlls
- C:\ProgramData\tklidtjy\xwhljjdr.dll