Troj/Haxdoor-BS is a Trojan for the Windows platform.
When Troj/Haxdoor-BS is installed the following files are created:
<System>\ddirectxt.sys
<System>\ddirectz.dll
The file ddirectxt.sys is detected as Troj/Haxdor-Gen and the file ddirectz.dll is detected as Troj/Haxdor-Fam.
The following registry entries are created to run code exported by ddirectz.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddirectz
DllName
ddirectz.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddirectz
Startup
ddirectz
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddirectz
Impersonate
1