Troj/Haxdoor-AH is a backdoor Trojan for the Windows platform.
When Troj/Haxdoor-AH is installed the following files are created:
<Windows system folder>\avpx32.dll
<Windows system folder>\avpx32.sys
<Windows system folder>\avpx64.sys
<Windows system folder>\p3.ini
<Windows system folder>\qy.sys
<Windows system folder>\qz.dll
<Windows system folder>\qz.sys
The files avpx32.dll and qz.dll are detected as Troj/Haxdor-Fam and the files avpx32.sys, avpx64.sys, qy.sys and qz.sys are detected as Troj/Haxdor-Gen.
The following registry entries are created to run code exported by avpx32.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
DllName
avpx32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Startup
MmMapView3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpx32
Impersonate
1
The file avpx32.sys is registered as a new system driver service named "avpx32", with a display name of "AVPX TCP" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\avpx32\
The file avpx64.sys is registered as a new system driver service named "avpx64", with a display name of "AVPX64 TCP". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\avpx64\
Troj/Haxdoor-AH attempts to use stealthing to prevent the detection and removal of its files. The Trojan runs continuously in the background listening for instructions from a remote user.
Sophos's anti-virus products include Genotype ™ detection technology, which can proactively protect against new threats without requiring an update. Sophos customers have been protected against Troj/Haxdoor-AH (detected as Troj/Haxdor-Gen) since version 3.95.