Troj/Abox-A is a downloading Trojan.
The Trojan writes an ftp script to a file in the Windows temporary folder. The script is then executed, resulting in the following files being downloaded to the Windows folder:
abox.exe
logon.exe
update.exe
logon.txt
abox.bup
At the time of writing, the EXE files are all detected as Troj/Abox-A while the other two files are harmless.
Troj/Abox-A creates the following registry entries so that the downloaded files are run during login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ABox = "C:\\WINDOWS\\ABox.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinLogon = "C:\\WINDOWS\\logon.exe"
The Trojan also creates the following key and several entries below it for its own use:
HKLM\Software\Carmen\
Troj/Abox-A may periodically transmit information about the infected computer via HTTP forms.