Troj/Asb-A is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
Troj/Asb-A includes functionality to:
- send notification messages to remote locations
- download files via HTTP without user notification
- log keystrokes and send the logged information to a remote location
- open/close CD drives
When Troj/Asb-A is installed the following files are created:
<Temp>\mswinsck.ocx - this file may be deleted
<Windows>\of.sys - this file may be deleted
<Windows>\win.exe - also detected as Troj/Asb-A
<Temp>\pic04.exe - also detected as Troj/Asb-A
The following registry entry is created to run win.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinLoad
<Windows>\win.exe