Troj/Haxdoor-AL is a backdoor Trojan for the Windows platform.
Troj/Haxdoor-AL allows a remote attacker to run arbitrary commands. The Trojan contains functionality to access the internet and communicate with a remote server via HTTP.
When Troj/Haxdoor-AL is installed the following files are created:
<System>\sksdll.dll
<System>\sksdrvr2.sys
The following registry entries are created to run code exported by sksdll.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
DllName
sksdll.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Startup
sksdll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sksdll
Impersonate
1
The file sksdrvr2.sys is registered as a new system driver service named "sksdrvr2", with a display name of "USB sksDRVR2". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\sksdrvr2\