Troj/Backdr-AU is a Trojan for the Windows platform.
When first run Troj/Backdr-AU copies itself to <System>\iomssls.exe.
The following registry entry is created to run iomssls.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
crsmons
<System>\iomssls.exe
The following registry entry is changed to run iomssls.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe,<System>\iomssls.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Taskman
<System>\iomssls.exe