Home Malware Programs Trojans Trojan.Milicenso

Trojan.Milicenso

Posted: June 22, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 9
First Seen: June 22, 2012
Last Seen: March 30, 2020
OS(es) Affected: Windows

Trojan.Milicenso is a Trojan downloader that uses advanced techniques to misrepresent itself as a low-level PC threat while Trojan.Milicenso is used for other attacks against the infected PC. Because Trojan.Milicenso's payload is configurable, the risks that can result from a Trojan.Milicenso infection may vary, but Trojan.Milicenso's trademark side effect is a series of seemingly-infinite printouts (due to Trojan.Milicenso's incorporation of a fake printer spool or .spl file in its infection routine). Trojan.Milicenso infections have been observable since 2010, but SpywareRemove.com malware researchers have noted a significant increase in Trojan.Milicenso attacks as of the time of this writing, and residents of India and the United States should be considered particularly at risk for potential infection by Trojan.Milicenso via fake video codec files.

How Trojan.Milicenso Uses Minor Malware to Hide Even Worse Intentions Than That

Trojan.Milicenso's modern versions have been found to be distributed to South America, Europe, the US and India through various methods, but especially by way of fake codec files. These faux codecs appear when you attempt to play a seemingly non-functional movie and are requested to update your player or a related media package, and acquire a Trojan.Milicenso infection instead of the desired codec. As usual, SpywareRemove.com malware researchers encourage potential victims of Trojan.Milicenso attacks (namely, anyone using Windows from versions 95 up to Server 2008) to install their media software only from reputable sources.

Trojan.Milicenso is particularly noted to include Adware.Eorezo as part of its default structure, but this appears to be a slight-of-hand misdirection rather than Trojan.Milicenso's primary payload. Since Trojan.Milicenso explicitly attempts to identify PC security 'sandboxes' or virtual environments and reacts to them by installing Eorezo, SpywareRemove.com malware researchers strongly suspect that Eorezo's presence is included merely as a way to make Trojan.Milicenso seem less dangerous than Trojan.Milicenso actually is. The unpleasant reality is that Trojan.Milicenso's functions can be configured to include the installation of many types of high-level PC threats, which makes Trojan.Milicenso itself a danger that should be removed with as much alacrity as can be assembled.

Trojan.Milicenso: From Movie Player to Printer Nightmare

During its installation, Trojan.Milicenso creates a fake .spl file in the Printer subdirectory of the System32 folder. Although this fake file actually is a malicious executable instead of a spool, associated printers are unable to determine this. As a result, computers that are infected by Trojan.Milicenso will often begin to print endless pages of seemingly random symbols. Thankfully, SpywareRemove.com malware researchers have found that this doesn't cause permanent harm to the printer in question; deleting Trojan.Milicenso's components in an anti-malware scan will return your printer's behavior to normal.

It's suggested that you embark upon this course of action ASAP, since Trojan.Milicenso can also lower your Internet Explorer security settings, change the Windows Registry without your consent and create an environment of vulnerability to other PC threats. Because Trojan.Milicenso uses encryption techniques, as well as other methods to avoid detection, keeping anti-malware software updated is also advised to maximize your Trojan.Milicenso-detection success rates.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 334.94 KB (334949 bytes)
MD5: e0bcce62bc17811660fdc8e882f8a119
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 26, 2012
file.exe File name: file.exe
Size: 332.8 KB (332800 bytes)
MD5: a6bb2fa68a4852f8f163deb64dd3b065
Detection count: 69
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 26, 2012
file.exe File name: file.exe
Size: 444.41 KB (444416 bytes)
MD5: c8e45651512cf3275b0d12307b27ae7d
Detection count: 68
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 26, 2012
xpsp4ress.dll File name: xpsp4ress.dll
Size: 163.84 KB (163840 bytes)
MD5: ee4e11342f6c94d31e212bdc8b003395
Detection count: 59
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: June 26, 2012
file.exe File name: file.exe
Size: 524.93 KB (524931 bytes)
MD5: baa1ad467a34144b20cea02e8b537979
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: March 30, 2020
%System%\[RANDOM CHARACTERS].dll File name: %System%\[RANDOM CHARACTERS].dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%Temp%\[RANDOM CHARACTERS].bat File name: %Temp%\[RANDOM CHARACTERS].bat
File type: Batch file
Mime Type: unknown/bat
Group: Malware file
%Windir%\Tasks\[RANDOM CHARACTERS].job File name: %Windir%\Tasks\[RANDOM CHARACTERS].job
Mime Type: unknown/job
Group: Malware file
%ProgramFiles%\[EXISTING FOLDER NAME]\[RANDOM FILE NAME].dll File name: %ProgramFiles%\[EXISTING FOLDER NAME]\[RANDOM FILE NAME].dll
Mime Type: unknown/dll
Group: Malware file
%ProgramFiles%\[EXISTING FOLDER NAME]\[RANDOM FILE NAME].exe File name: %ProgramFiles%\[EXISTING FOLDER NAME]\[RANDOM FILE NAME].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\[RANDOM FILE NAME].exe File name: %System%\[RANDOM FILE NAME].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%Temp%\[RANDOM FILE NAME].exe File name: %Temp%\[RANDOM FILE NAME].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%Temp%\[RANDOM FILE NAME].dll File name: %Temp%\[RANDOM FILE NAME].dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\"1900:TCP" = "1900:TCP:LocalSubNet:Enabled:UDP 1900"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"2" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"4" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"5" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"7" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"8" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\"9" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"2" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"4" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"5" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"7" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"8" = "[BINARY DATA]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\"9" = "[BINARY DATA]"HKEY_CURRENT_USER\System\CurrentControlSet\"1" = "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\System\CurrentControlSet\"10" = "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\System\CurrentControlSet\"3" = "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\System\CurrentControlSet\"4" = "[RANDOM CHARACTERS]"HKEY_CURRENT_USER\Software\NKARYVBF\"Sg" = "[BINARY DATA]"HKEY_CURRENT_USER\System\CurrentControlSet\"8" = "1"HKEY_CURRENT_USER\System\CurrentControlSet\"9" = "1"HKEY_CURRENT_USER\System\CurrentControlSet\"5" = "1"HKEY_CURRENT_USER\System\CurrentControlSet\"7" = "1"HKEY_USERS\.DEFAULT\Software\NKARYVBF\"Sg" = "[BINARY DATA]"HKEY_USERS\.DEFAULT\System\CurrentControlSet\"5" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"1" = "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"10" = "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\FreeCodec_I\DEBUG\"Trace Level" = ""HKEY_LOCAL_MACHINE\SOFTWARE\NKARYVBF\"Sg" = "[BINARY DATA]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"3" = "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"4" = "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"8" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"9" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"5" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\"7" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"[RANDOM VALUE]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"[RANDOM VALUE]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"[RANDOM VALUE]" = "[PATH TO TROJAN EXECUTABLE]"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\[RANDOM VALUE]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MultimediaHKEY_CURRENT_USER\ Software\Microsoft\Multimedia
Loading...