TrojanHunter vs. the Parasitic Beast Trojan

The Beast - Employing Modern Stealth Techniques

The Beast is a relatively new trojan which in recent versions has used more advanced techniques to make itself undetectable from trojan and virus scanners. The latest technique employed makes the trojan parasitic, because it injects its code into other processes running on the system. For this purpose, the trojan uses a DLL file named dxgns.dll.

To study this trojan, let's see what happens when it is run on a typical Windows XP Home system. A quick analysis after starting the trojan reveals that it injects itself into the following two processes: winlogon.exe and explorer.exe. These two processes are always present on a Windows XP system (in fact they are present on any NT-based system), which is why the trojan injects itself into those processes. You can see from the screenshots below that the injected trojan library is running inside the infected processes.



Process Injection - A Dangerous New Trend

Recent trojans have begun using process injection to a greater extent. Several factors make this technique dangerous:
  • The trojan is not visible in traditional process viewers, including Windows Task Manager
  • Most trojan and virus scanners have a very hard time detecting the running trojan code
  • The trojan code is very difficult to unload

How TrojanHunter Cleans the Trojan

TrojanHunter is the only trojan scanner on the market that is able to clean parasitic trojans. Other scanners will leave the user stranded or might even incorrectly kill the legitimate host processes, with devastating effects as a result (terminating winlogon.exe will crash the operating system). TrojanHunter cleans parasitic trojans by actually working inside the infected process to kill all trojan threads and then unload the loaded trojan libraries. After this, the trojan library can safely be cleaned by TrojanHunter as with any other trojan file, while the previsouly infected process can continue executing as if nothing had happened.

The screenshot below shows TrojanHunter diasbling the Beast trojan. Note that no reboot is necessary. Other trojan scanners would either not have detected the trojan, or, if detected, wouldn't have been able to clean the trojan - leaving the user with little choice but to reformat or hire an expensive computer technician to remove the trojan from the system.



More Information About TrojanHunter

TrojanHunter Web Page
Buy TrojanHunter Online Now