Troj/ConHook-H is a Trojan for the Windows platform.
The Trojan attempts to download and run further malicious code without the user's knowledge.
When Troj/ConHook-H is installed the following files are created:
<Windows system folder>\awvvv.dll
The following registry entries are created to run code exported by awvvv.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvvv
DllName
awvvv.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvvv
Impersonate
0
The file awvvv.dll is registered as a COM object and ShellExecute hook, creating registry entries under:
HKCR\CLSID\{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26}