Short description
Win32/Wigon.NI is a trojan that installs
Win32/Wigon.KQ
malware.
Installation
The trojan copies itself in the following locations:
- %windir%\system32\reader_s.exe
- %userprofile%\reader_s.exe
The files are then executed.
In order to be executed on every system start, the modifies the following Registry keys:
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run]
"reader_s" = %windir%\system32\reader_s.exe"
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run]
"reader_s" = "%userprofile%\reader_s.exe"
Other information
The trojan creates and runs a new thread with its own program code within the following processes:
