Trojan.Naid is a Trojan horse that opens a back door on the compromised computer.
When the Trojan is executed, it creates the following files:
The Trojan creates the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Start" = "2"
= "%UserProfile%\AppMgmt.dll" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Type" = "272"
= "[BINARY DATA]"
The Trojan may create one of the following services so that it runs
every time Windows starts:
The Trojan collects the following system information from the
domain name unique identifier (UID)
The Trojan utilises its own custom communications protocol to connect
to the following IP address over port 443:
The Trojan then opens a back door on the compromised computer.
So you should inspect at least mentioned paths, keys and services.
But trojan could be modified, so I'd also recommend to inspect network connections using
netstat or Process Monitor and other tools from Sysinternals Suite.