Troj/Haxdoor-CO is a Trojan for the Windows platform.
When Troj/Haxdoor-CO is installed the following files are created:
<Temp>\10320054.gif
<System>\dvb03a.dll
<System>\dvb03a.sys
<System>\dvb06a.sys
<System>\kgctini.dat
<System>\klo5.sys
<System>\lps.dat
<System>\qo.dll
<System>\qo.sys
The files dvb03a.dll, dvb03a.sys, dvb06a.sys, qo.dll and qo.sys are detected as Troj/Haxdor-Fam. The other files are clean configuration and data files.
The following registry entries are created to run code exported by dvb03a.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
DllName
dvb03a.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
Startup
DVBz637890
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
Impersonate
1
The file dvb06a.sys is registered as a new system driver service named "dvb06a", with a display name of "WDVB 05". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\dvb06a\
The following registry entries are set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS
Explorer.EXE
<Windows>\Explorer.EXE:*:Enabled:explorer