Trojan-dropper.W32.Paradrop.a

I ran a scan on my Win XP m/c yesterday with A squared and it found the above trojan, as part of Khooker.exe. Thinking it may be a FP I also ran Ewido but this also found it. It is listed as Khooker.exe, a file that is installed with SIS system VGA drivers. I googled it and many sites said this KHOOKER ,exe is a useless file and delete it. So I quarantined it with Ewido. I then googled for Trojan-dropper.W32.Paradrop.a and nothing was found on the whole net! Can anybody throw any light on this trojan.?
Thanks Gordon

 

Hi ghodgson,

Further investigation here may tell you if it's malicious ....

xxxx://www.sophos.com/virusinfo/analyses/w32paradropa.html <- swap x's

or supposedly installed as an automated background process ....

xxxx://www.infopackets.com/channels/en/windows/gazette/2003/20030917_sis_khooker_downloadware_and_video_display_trouble_part_2.htm

Maybe a fp but I couldn't confirm this. If it show's up as an 04 entry in HJT, most likely the latter.
Wait for more replies as I'm sure other's will answer.


GF

 

Could be this:-

http://castlecops.com/s1790-khooker.html

http://castlecops.com/s3346-SiS_KHooker.html

But the obvious thing to do is upload the file to Jotti's and see if any other scanners finger it:-

http://virusscan.jotti.org/

Trojan-dropper.W32.Paradrop.a appears on the emisoft sig list:-

http://www.emsisoft.com/a2/malware/a2.txt

but other vendors will use different names.

 

Thanks guys, I uploaded the file to Jotti's and it found nothing, it said it was clear. So it looks like a FP, strange that EWIDO and A-SQUARED both identified it as the said trojan. Wonder if Andreas Haak wants to know about this.
However, the end point being I am going to quarantine it anyway because all the references to KHooker.exe says it can cause problems at startup, so delete it. So nothing lost.
Thanks again.
Gordon

 

Uploaded the file to Ewido and A squared yesterday, Ewido have already replied saying this FP will be fixed on the next update. Hows that for service?
Gordon